RHSA-2026:43940 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: golang1.27: golang1.27-1.27.0-0.1.hum1 aarch64, x8664 golang1.27-bin-1.27.0-0.1.hum1 aarch64, x8664 golang1.27-docs-1.27.0-0.1.hum1 noarch golang1.27-misc-1.27.0-0.1.hum1 noarch...

EUVD-2026-63190

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2026-70462 affecting package rsync for versions less than 3.5.0-1

CVE-2026-70462 affecting package rsync for versions less than 3.5.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-70460 affecting package rsync for versions less than 3.5.0-1

CVE-2026-70460 affecting package rsync for versions less than 3.5.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-73070 affecting package vim for versions less than 9.2.0957-1

CVE-2026-73070 affecting package vim for versions less than 9.2.0957-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-73074 affecting package vim for versions less than 9.2.0957-1

CVE-2026-73074 affecting package vim for versions less than 9.2.0957-1. An upgraded version of the package is available that resolves this issue...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: postgresql17: postgresql17-17.11-1.hum1 aarch64, x8664 postgresql17-contrib-17.11-1.hum1 aarch64, x8664 postgresql17-docs-17.11-1.hum1 aarch64, x8664 postgresql17-plperl-17.11-1.hum1 aarch64, x86...

PT-2026-79080

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22 Description A remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http cb function in src/http.c...

PT-2026-79060

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password hash is None. A fresh deployment reaches that state when DBX PASSWORD is unset and no stored password...

Virtuozzo Infrastructure 7.4 Hotfix 2 (7.4.0-80)

This update provides stability and security fixes. Vulnerability id: VSTOR-140619 A security fix for CVE-2026-64531. Vulnerability id: VSTOR-140678 A security fix for CVE-2026-64561. Vulnerability id: VSTOR-87519 Storage version bumping could remain disabled until the end of a cluster update,...

CVE-2026-68900

creationtimestamp| type| source ---|---|--- 2026-08-19 21:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthmtw75wv2t...

CVE-2026-68554 Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

CVE-2026-55086

Etherpad (ep_etherpad-lite) versions prior to 3.1.0 are vulnerable to a symlink-based file overwrite via predictable temporary filenames. The ImportHandler.ts and ExportHandler.ts components derive temp-file paths from Math.random() (~32 bits of entropy), which is predictable within the same Node...

CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

EUVD-2026-42309

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted...

CVE-2026-71050

creationtimestamp| type| source ---|---|--- 2026-08-19 18:16:57+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-62531

creationtimestamp| type| source ---|---|--- 2026-08-19 17:49:12+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-61268

creationtimestamp| type| source ---|---|--- 2026-08-19 17:47:52+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-75141

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers...