CVE-2026-50105: Exposure of Sensitive Information to an Unauthorized Actor

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

.NET 10.0 security, bug fix, and enhancement update

10.0.111-1.0.1 - Add support for Oracle Linux 10.0.111-1 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235478...

OPENSUSE-SU-2026:11508-1 pgadmin4-9.17-1.1 on GA media

These are all security issues fixed in the pgadmin4-9.17-1.1 package on the GA media of openSUSE Tumbleweed...

.NET 8.0 security, bug fix, and enhancement update

8.0.130-1.0.1 - Add support for Oracle Linux 8.0.130-1 - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235468...

PT-2026-76432

These are all security issues fixed in the kernel-devel-7.1.8-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-64541 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64541 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-47718

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. When secureEnabled=true, FUXA 1.3.0-2773 still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue...

CVE-2026-73498

The MCP Atlassian MCP server (Confluence/Jira) is affected by an arbitrary file read in confluence_upload_attachment prior to version 0.22.0. The function passes a client-supplied file_path directly to open(file_path, "rb") via _upload_attachment_direct() without validating the path, allowing an ...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.18.1-0.2.2.hum1 aarch64, x8664 nodejs24-bin-24.18.1-0.2.2.hum1 noarch nodejs24-devel-24.18.1-0.2.2.hum1 aarch64, x8664 nodejs24-docs-24.18.1-0.2.2.hum1 noarch...

CVE-2026-73422 Astro: Reflected XSS via unescaped View Transition animation properties

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack

A flaw was found in Next.js. A remote unauthenticated attacker could exploit a bypass in a security fix when using middleware.ts with Turbopack. This vulnerability could lead to the disclosure of sensitive information...

CVE-2026-73301

CVE-2026-73301 (Budibase) describes a missing RBAC check on GET /api/global/groups in Budibase prior to 3.39.25. An authenticated BASIC user could enumerate tenant groups, role mappings, and user memberships, effectively exposing the tenant access-control structure to non-builder/ non-admin users...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: cosign: cosign-3.1.3-0.1.hum1 aarch64, x8664 cosign-3.1.3-0.1.hum1.src src...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nats-server2.12: nats-server2.12-2.12.15-0.1.hum1 aarch64, x8664 nats-server2.12-2.12.15-0.1.hum1.src src...

CVE-2026-73238

XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.3-0.1.hum1 aarch64, x8664 grafana13.1-13.1.3-0.1.hum1.src src...

CVE-2026-15803

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

CVE-2026-15803

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-54183

Apache Airflow contains a vulnerability where the secrets masker fails to hide sensitive values in the Variables UI when those values are nested within lists, tuples, or sets beyond a specific recursion-depth limit. This is an incomplete-fix follow-up to CVE-2026-42358 . While the exposure is lim...