PT-2026-65855

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in text and mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup,...

PT-2026-65891

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7 Description The HTTP modules http.get, http.request, and http.batch validate only the initial URL. When allow redirects is set to True, the system follows redirects without per-hop Location revalidation. Th...

PT-2026-65847

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extract plain tar in proot distro/commands/install.py and Docker layers through apply layer in proot distro/helpers/docker.py without validating...

PT-2026-65915

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

openSUSE 16 Security Update : perl-YAML-Syck (openSUSE-SU-2026:21452-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21452-1 advisory. Changes in perl-YAML-Syck: - updated to 1.470.0 1.47 Security - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load...

SUSE SLES15 Security Update : kernel (Live Patch 26 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:3344-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3344-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.112 fixes various security issues: The following security issues were fixed: -...

PT-2026-65873

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.0 through 19.0.4 GitLab EE versions 19.1 through 19.1.2 GitLab EE versions 19.2 through 19.2.0 Description A race condition in approval rule processing may allow an authenticated user to merge code into a protected branch...

PT-2026-65896

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The image.download and related file-writing modules use a caller-controlled output dir instead of the validate path with env config function and its FLYTO SANDBOX DIR confinement. This allows...

openSUSE 16 Security Update : yq (openSUSE-SU-2026:21454-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21454-1 advisory. Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add...

SUSE SLES16: go1.24 / go1.24-doc / go1.24-openssl / go1.24-openssl-doc / etc (SUSE-SU-2026:22950-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22950-1 advisory. Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: Revert %ghost /usr/bin/go /usr/bin/gofm...

Linux Distros Unpatched Vulnerability : CVE-2026-41920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3...

openSUSE 16 Security Update : perl-Mojolicious (openSUSE-SU-2026:21451-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21451-1 advisory. Changes in perl-Mojolicious: - updated to 9.480.0 9.48 - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now mask...

Linux Distros Unpatched Vulnerability : CVE-2026-59943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can...

kernel security update

6.12.0-211.39.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-59921

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.6-0.2.hum1 aarch64, x8664 grafana12.4-12.4.6-0.2.hum1.src src...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.1-0.2.hum1 aarch64, x8664 grafana13.1-13.1.1-0.2.hum1.src src...

EUVD-2026-50089

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...

Chromium: CVE-2026-15121 Use after free in WebRTC

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...