Astra Linux – Vulnerability in binutils

A vulnerability has been discovered in GNU Binutils 2.45. The affected element is the function elfswapshdr in the bfd/elfcode.h library of the Linker component. Manipulation of this function leads to a heap-based buffer overflow. This attack must be carried out locally. The exploit has been...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 9.4.0 through 9.4.46, and 10.0.0 through 10.0.9, as well as 11.0.0 through 11.0.9, the parsing of the authority segment of an http scheme URI causes the Jetty HttpURI class to incorrectly detect an invalid input as a hostname. This can lead to failures in a Proxy scenari...

CVE-2026-14331

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CLSA-2026-1784683020 TuxCare security update for io.netty (2 CVEs)

TuxCare rebuilt 6 io.netty packages to address 2 CVEs. Fixed in 4.1.73.Final-tuxcare.2...

CLSA-2026-1784164029 TuxCare security update for io.netty (1 CVE)

TuxCare rebuilt 4 io.netty packages to address 1 CVE. Fixed in 4.1.75.Final-tuxcare.2...

CLSA-2026-1777336751 TuxCare security update for io.netty (1 CVE)

TuxCare rebuilt 29 io.netty packages to address 1 CVE. Fixed in 4.1.82.Final-tuxcare.2...

RUSTSEC-2026-0225 Debug output exposes NIP-46 and NIP-60 credentials

Several NIP-46 and NIP-60 types used derived Debug implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys, Cashu bearer proofs, and quote...

CLEANSTART-2026-HY96164 Security fixes in kubernetes-event-exporter-fips 1.7-r0

Package kubernetes-event-exporter-fips version 1.7-r0 fixes 46 vulnerabilities: ghsa-wf45-q9ch-q8gh, ghsa-p77j-4mvh-x3m3, ghsa-gxhx-2686-5h9g, CVE-2026-41602, CVE-2026-33186...

Security Bulletin: Vulnerability affect cryptography-46.0.5, and bcprov-jdk18on-1.82.jar IBM COS Systems (July 2026)

Summary Vulnerability with cryptography-46.0.5 CVE-2026-39892, and bcprov-jdk18on-1.82.jar CVE-2025-14813, CVE-2026-5598 . This vulnerability has been addressed in the latest ClevOS release. Vulnerability Details CVEID:CVE-2026-39892 DESCRIPTION: cryptography is a package designed to expose...

CVE-2026-15158 Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter

The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the saveattachments function. This is due to the Custom Fonts extension registering a wpcheckfiletypeandext filter that approves any filename containing .woff2 or .tt...

CVE-2026-6412 Continued acceptance of SHA-1/MD5 digests in certificate processing

Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...

MINI-PPWM-GP46-RXV7

Bulletin has no description...

SUSE SLES15 Security Update : kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:2158-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2158-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.184 fixes various security issues The following security issues were fixed: ...

GHSA-2XF4-CG6J-VHGQ symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

Description symfony/polyfill-intl-idn provides a userland implementation of idntoutf8 and idntoascii for runtimes that lack the intl extension. Its Idn::process method decodes labels prefixed with xn-- using Punycode but never enforces the validity criterion added in UTS 46 revision 33 Section 4...

Google Rolls Out DBSC in Chrome 146 to Block Session Theft on Windows

Google has made Device Bound Session Credentials DBSC generally available to all Windows users of its Chrome web browser, months after it began testing the security feature in open beta. The public availability is currently limited to Windows users on Chrome 146, with macOS expansion planned in a...

CVE-2026-39415

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated...

EUVD-2026-20603

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated...

CVE-2026-22735

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE. This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46...

Unity Linux 20.1070a Security Update: binutils (UTSA-2026-006232)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006232 advisory. A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elfswapshdr in the library bfd/elfcode.h of the component Linker. The...

CVE-2025-69644

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless...