CVE-2026-96649: Improper Neutralization of Input During Web Page Generation

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

RHEL 8 : postgresql:12 (RHSA-2026:73912)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73912 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778129970)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778129970 advisory. - During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the...

RHEL 9 : kernel (RHSA-2026:73645)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73645 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: linux/dim: Fix divide by 0 in...

RHEL 10 : kernel (RHSA-2026:73788)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73788 advisory. A special build of the kernel packages for Red Hat Enterprise Linux for NVIDIA. For more details about the security issues, including the...

ALSA-2026:73519 Important: ruby:2.5 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 rubygem-mongo:...

RHEL 10 : expat (RHSA-2026:74001)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74001 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute...

CentOS Linux 6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (CENTOS6:CLSA-2026:1778147777)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778147777 advisory. - In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an...

RHEL 8 : rsync (RHSA-2026:74095)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74095 advisory. The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because...

RHEL 9 : gimp (RHSA-2026:73768)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73768 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

RHEL 8 : thunderbird (RHSA-2026:73971)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:73971 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Worke...

SUSE CVE-2026-85644

XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV rather than SvROK. SvRV reads a union slot...

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...

GHSA-H3MG-XC3C-68PW ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...

SUSE CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the BatchActivator.quote method in src/virtualenv/activation/batch/init.py, which previously returned its input string unchanged. When a virtualenv is created in a path containing cmd.exe operator characters such a...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, strimzi-kafka-operator-fips, cruise-control-fips, cassandra-fips, kates-fips, neo4j, s3proxy-fips, apache-pulsar, ranger, flink-kubernetes-operator-fips, commercial-elasticsearch, thingsboard, cruise-control, elasticsearch-fips, cassandra, apache-ho...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, strimzi-kafka-operator-fips, cruise-control-fips, cassandra-fips, kates-fips, neo4j, s3proxy-fips, apache-pulsar, ranger, flink-kubernetes-operator-fips, commercial-elasticsearch, thingsboard, cruise-control, elasticsearch-fips, cassandra,...

GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, strimzi-kafka-operator-fips, cruise-control-fips, cassandra-fips, kates-fips, neo4j, s3proxy-fips, apache-pulsar, ranger, flink-kubernetes-operator-fips, commercial-elasticsearch, thingsboard, cruise-control, elasticsearch-fips, cassandra,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, strimzi-kafka-operator-fips, cruise-control-fips, cassandra-fips, kates-fips, neo4j, s3proxy-fips, apache-pulsar, ranger, flink-kubernetes-operator-fips, commercial-elasticsearch, thingsboard, cruise-control, elasticsearch-fips, cassandra, apache-ho...