CVE-2026-12894 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-6464

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

CVE-2026-74010

bbPress (WordPress plugin by John James Jacoby) versions up to and including 2.6.14 contain a Missing Authorization (Broken Access Control) vulnerability that allows exploitation of incorrectly configured access control security levels. The CVSS 3.1 score is 5.3 (MEDIUM) with a network vector, no...

CVE-2026-74010 WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

EUVD-2026-68504

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

CVE-2026-74010 WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

RLSA-2026:61240 Moderate: pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref CVE-2026-14324 pipewire: Pulse Server alloca Stack Overflow CVE-2026-14330 For more details about the security issues, including the impact, a CVSS score, acknowledgment...

libxml2 security update

An update is available for libxml2. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...

RLSA-2026:61247 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via...

php security, bug fix, and enhancement update

An update is available for php. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...

pipewire security update

An update is available for pipewire. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PipeWire is a multimedia server for Linux and other Unix like operating...

RLSA-2026:61259 Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Servic...

mingw-sqlite security update

An update is available for mingw-sqlite. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list SQLite is a C library that implements an SQL database engine. A large...

RLSA-2026:61242 Important: mingw-sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...

RLSA-2026:61257 Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fixes: iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via...

iperf3 security update

An update is available for iperf3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Iperf is a tool which can measure maximum TCP bandwidth and tune various...

libxml2 security update

An update is available for libxml2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...

RLSA-2026:61248 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 For more details about the security issues, including the impact, a CVSS score,...

`zbus_polkit`: authorization bypass via PID reuse

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

RUSTSEC-2026-0278 `zbus_polkit`: authorization bypass via PID reuse

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...