Important: Red Hat Security Advisory: rust-rpm-sequoia security update

An update for rust-rpm-sequoia is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

Important: Red Hat Security Advisory: rust-rpm-sequoia security, bug fix, and enhancement update

An update for rust-rpm-sequoia is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

The vulnerability of the ReadyScript e-commerce management system, related to improper session management, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ReadyScript e-commerce management system is related to improper session management. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the “REDAAM” IT-infrastructure centralized management system, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the “REDAAM” IT-infrastructure centralized management system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management related to the lack of authentication for critical functions, allowing attackers to compromise the integrity and accessibility of protected information

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...

The vulnerability of the Test IT testing management system, related to the use of default login credentials, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Test IT testing management system is related to the use of default login credentials. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the FOQUZ platform, related to incorrect restrictions on the name of the path to the catalog, allows attackers to compromise the integrity of the protected information.

The vulnerability of the FOQUZ platform is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of the FOQUZ platform, related to the incorrect duration of a session, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the FOQUZ platform is related to an incorrect session duration. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

The vulnerability of the FOQUZ platform, related to synchronization errors when using a shared resource, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the FOQUZ platform is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

CVE-2026-93317

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

CVE-2026-86326

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...

PT-2026-104202

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...

CVE-2026-73975

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying DELETE/INSERT query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in t...

CVE-2026-73975 djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying DELETE/INSERT query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in t...

CVE-2026-73975

The research data repository system djehuty , developed by 4TU.ResearchData, is vulnerable to an authenticated SPARQL injection in versions prior to 26.3.2 . An authenticated depositor can supply a crafted session name to inject arbitrary SPARQL into state-modifying (DELETE/INSERT ) queries. This...

CVE-2026-73975 djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying DELETE/INSERT query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in t...