PT-2026-90826

This update for kubevirt, virt-pr-helper-container fixes the following issues: Changes in kubevirt: - Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into plac...

CVE-2026-85169: Improper Control of Generation of Code

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototyp...

Tenda AC18 Telnet Handler Full Control

The vulnerability of the /goform/telnet file of the Telnet Handler component in the Tenda AC18 microprogramming router software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system...

PT-2026-85261

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback url/sync interval results in os command injection. The attack can be initiat...

PT-2026-85001

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.73 n8n versions prior to 2.35.4 n8n versions prior to 2.36.2 Description An expression sandbox escape exists in the $fromAI handler. The $fromAI handler resolved caller-supplied placeholder names without verifying i...

wget security, bug fix, and enhancement update

1.19.5-16.0.1 - SSLv3 support dropped from openssl, v3 test certificates need to be replaced Orabug: 29613455 1.19.5-16 - Resolves: RHEL-145875 - async unsafe code in signal handler context 1.19.5-15 - Fix CVE-2026-58469: buffer underflow in cleanmetalinkstring - Resolves: RHEL-212496 1.19.5-14 -...

PT-2026-85274

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay proce...

IBM RSA service processor driver Heap Buffer Overflow DoS

The vulnerability in the ibmasmhandlemouseinterrupt function within the drivers/misc/ibmasm/remote.c file of the IBM RSA service processor driver for the Linux operating system is related to improper validation of a specified index, position, or offset in input data. Exploitation of this...

AlmaLinux 10 : wget (ALSA-2026:62142)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:62142 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution or...

CVE-2026-80743: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: pass auddrvdata to irq handlers The irq handlers take a struct device pointer and call devgetdrvdata to obtain the driver data. However, the driver data is only set at the end of probe, after...

PT-2026-84991

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...

Linux Distros Unpatched Vulnerability : CVE-2026-84366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler...

PT-2026-84941

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASoC xilinx formatter pcm component where interrupt handlers use dev get drvdata to retrieve driver data. Because the driver data is only assigned at the end of th...

CVE-2026-85223: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

EUVD-2026-69647

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default...

Malicious code in auth-handler (npm)

Source: amazon-inspector 79d1be042f1565157d9c5e97b927919aa32bedb254b501aa374caf00c242ee83 The package auth-handler was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-84852

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Ipados

CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU...

CVE-2026-84852

A path traversal vulnerability exists in Reader Tools PDF Reader App version 98.8 for Android. The flaw resides in the ActSplashNew.handleDeeplink function of the File Handler component, where manipulation of the _display_name argument allows local path traversal. The attack requires local access...

EUVD-2026-70259

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...