perl-Date-Manip security update

6.94-5.1 - Fix CVE-2026-60075: prevent quadratic-cost regex DoS in date/time parsing by rejecting overly long input strings Resolves: RHEL-239790...

PT-2026-78411

Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...

CVE-2026-61711: Improper Input Validation

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

PT-2026-78313

The ISO-2022 encoding module used a stack buffer sized to MB LEN MAX 6 bytes for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv3 to...

PT-2026-78498

Name of the Vulnerable Software and Affected Versions Cisco Secure Workload affected versions not specified Description Improper input validation issues exist within the software. These issues are categorized under CWE-20, which refers to a failure to properly validate input before it is processe...

PT-2026-78778

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway...

PT-2026-78493

A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

PT-2026-78710

IBM Reliable Scalable Cluster Technology RSCT 3.0 could allow a remote attacker to cause a denial of service by sending a specially crafted request due improper input validation...

ROS-20260819-73-0045

The vulnerability in containerd is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Content Credentials SDK Insufficient Validation Privilege Escalation

The vulnerability of Content Credentials SDK library libraries is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

Content Credentials SDK Insufficient Validation Bypass

The vulnerability of the Content Credentials SDK libraries is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

Adobe Lightroom Classic Buffer Overflow Code Execution

The vulnerability of the Adobe Lightroom Classic graphic editor is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

RDK-B WebUI contains multiple vulnerabilities

Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication,...

FreeIPA -- multiple vulnerabilities

The FreeIPA project reports: CVE-2026-76578: the access control instruction for self-managed OTP tokens requires no authentication and does not restrict which attributes may be written alongside the token entry. An unauthenticated LDAP client can create a Kerberos principal and add it to the...

CVE-2026-66591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-27365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...

Improper Validation of Specified Type of Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the request validation path in lib/validation.js. An attacker can bypass body schema type enforcement by sending a root-level primitiv...

CVE-2026-27365 WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...

CVE-2026-27365

The WordPress PublishPress Series plugin (versions through 2.17.0) has a stored XSS flaw from improper input neutralization during page generation. Patchstack rates it MEDIUM (CVSS 5.9) requiring high privileges and user interaction. No exploitation data is provided. Upgrade to a patched version ...

CVE-2026-66603

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...