PoD: Don't try to reclaim special pages

ISSUE DESCRIPTION A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen. IMPACT A buggy or malicious guest can cause corruption of Xen's state, leading to crashes or other...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.22.7 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.7 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

CVE-2026-66053

A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's...

CVE-2026-16773

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...

CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...

EUVD-2026-49760

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...

CVE-2026-58348

A flaw was found in Moodle. Missing capability checks in the report builder fragment callbacks could allow authenticated users to retrieve report data that they are not authorized to access. This could lead to information disclosure...

WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure

The 3D FlipBook WordPress plugin ≤ v1.16.17 has a vulnerability where an unauthenticated AJAX action fb3dsendposts exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization. id: CVE-2025-5822...

CVE-2026-58246

SAP NetWeaver Application Server for ABAP and ABAP Platform is affected by CVE-2026-58246, where sensitive session identifiers are written into diagnostic traces when tracing is enabled by a privileged user. An attacker with access to the resulting trace data could use these identifiers to impers...

CVE-2026-58246 Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate...

CVE-2026-57221

A flaw was found in RabbitMQ. This vulnerability allows an authenticated user, with the ability to connect to a virtual host, to bypass authorization checks during passive queue.declare and exchange.declare AMQP 0-9-1 Advanced Message Queuing Protocol operations. This bypass enables the user to...

Security update for libssh

This update for libssh fixes the following issues: CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. CVE-2026-59844: denial of service via oversized SFTP read length bsc1272165. CVE-2026-59845: denial of service via unchecked ProxyCommand fork failure bsc127216...

[SECURITY] [DLA 4702-1] openjdk-11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4702-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 28, 2026 https://wiki.debian.org/LTS -...

CVE-2026-59897

A flaw was found in Hono, a web application framework. The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values using a substring comparison, rather than an exact match. This can lead to incomplete data being received by middleware or application logic that relies o...

CVE-2026-59896

A flaw was found in Hono, a Web application framework. The hono/jsx component did not properly isolate context values per request during server-side rendering. This allowed data from a different in-flight request to be used after an asynchronous operation in a component. This could lead to...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc

A flaw was found in Apache HTTP Server, specifically within the modxml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service,...

CVE-2026-50135

A flaw was found in Hugo, a static site generator. A regression in the resources.Get function caused it to follow symbolic links symlinks, which are special files that point to other files or directories. This vulnerability allows an attacker who can place a symlink within a local mount point, su...

CVE-2026-58403

A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink symbolic link planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to...

CVE-2026-17552

creationtimestamp| type| source ---|---|--- 2026-07-28 06:26:30+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrorppc7qt2u 2026-07-30 04:58:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtnpf76j523...

CVE-2026-59924

A flaw was found in Mistune, a Python Markdown parser. The Include.parse function does not properly verify user-supplied include paths, allowing an attacker to craft paths that can access files outside the intended markdown directory. This can lead to information disclosure when markdown files ar...