Important: libXrender

Issue Overview: A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Affected Packages: libXrender Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

CVE-2026-109357: Improper Neutralization of Special Elements used in an LDAP Query

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

PT-2026-110625

Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.1.2 Thelia versions 3.2.x prior to 3.2.1 Description An issue exists where unauthenticated visitors can perform CSV formula injection by providing specially crafted data in registration, checkout, or newsletter field...

PT-2026-110641

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.9 Description An XQuery injection flaw exists in a deprecated Management API package path. A remote attacker with manage-user-level privileges can...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2026-4295)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context...

PT-2026-110513

Name of the Vulnerable Software and Affected Versions Kong Gateway versions prior to 3.9.4 Description A SQL Injection SQLi exists in the clustering communication logic of Kong Gateway Enterprise and Open Source when operating in Hybrid Mode. An attacker can trigger this issue by sending speciall...

CVE-2026-108927: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument bid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made availab...

PT-2026-110858

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description Remote command injection is possible due to improper processing of the /goform/formAutoFWupgrade endpoint. An attacker can execute arbitrary commands by manipulating the tftpsIP argument. Recommendatio...

PT-2026-110997

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

PT-2026-110868

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description Command injection is possible via remote manipulation of the readE2P argument within a function in the /goform/formWlanMP endpoint. This issue affects products that are no longer supported by the...

PT-2026-110725

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.6 Craft CMS versions 5.0.0 through 5.10.13 Description Authenticated control panel users with the performUpdates permission or Updates-utility access can execute arbitrary code. The issue occurs because th...

PT-2026-110910

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed...

VulnCheck KEV: CVE-2026-0702

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Important: qt5-qtbase

Issue Overview: Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not...

EulerOS 2.0 SP11 : dracut (EulerOS-SA-2026-4224)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options,...

Rocky Linux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.6:CLSA-2026:1791456473)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791456473 advisory. - Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4,...

Rocky Linux 9.6 [TuxCare] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (ALMALINUX9.6:CLSA-2026:1791796759)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791796759 advisory. - MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated...

AlmaLinux 9.6 [TuxCare] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (ALMALINUX9.6:CLSA-2026:1791796759)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791796759 advisory. - MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated us...

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure...