RLSA-2026:50728 Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command...

Important: Red Hat Security Advisory: iscsi-initiator-utils security, bug fix, and enhancement update

An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PT-2026-82624

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...

PT-2026-82728

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize value/2 in lib/doggo.ex returned date field values wrapped in :safe, ..., the Phoenix.HTML marker meaning "already escaped, emit verbatim", withou...

PT-2026-82827

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A type confusion issue in the iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic. Type confusion occur...

PT-2026-82734

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

CVE-2026-30612

Time4 Popcorn (Windows ≤ 6.2.1.18, macOS ≤ 6.2.1.17, Android ≤ 3.5.0.173) contains a vulnerability that allows a remote attacker to execute arbitrary code via the updater.exe component on Windows and the PT.updd component on macOS. The underlying root cause is not further detailed in the provided...

PT-2026-82655

An issue in Time4 Popcorn for Windows = 6.2.1.18 and Time4Popcorn for MacOS = 6.2.1.17 and Time4Popcorn for Android = 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components...

CVE-2026-26897

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

EUVD-2026-67100

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

PT-2026-82660

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

EUVD-2026-67253

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

EUVD-2026-67122

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

CVE-2026-30612

An issue in Time4 Popcorn for Windows = 6.2.1.18 and Time4Popcorn for MacOS = 6.2.1.17 and Time4Popcorn for Android = 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components...

CVE-2026-26897

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

TencentOS Server 3: postgresql:12 (TSSA-2026:0920)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0920 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Security update for gh (important)

openSUSE security update: security update for gh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21663-1 Rating: important References: bsc1266618 bsc1276661 bsc1276662 bsc1276663 bsc1276664 Cross-References: CVE-2026-39821 CVE-2026-64652...

Security update for xmlrpc-c (moderate)

openSUSE security update: security update for xmlrpc-c ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21633-1 Rating: moderate References: bsc1272769 Cross-References: CVE-2026-15928 CVSS scores: CVE-2026-15928 SUSE : 5.4...