OESA-2026-3748 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.CVE-2026-73282 In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys...

OESA-2026-3746 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.CVE-2026-73282 In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys...

OESA-2026-3747 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the...

CVE-2026-89497

A flaw was found in the Linux kernel's Orange File System orangefs client. The orangefspreparecdmarray function incorrectly calculates the buffer size for client debug keywords when an entry starts with a space. This can lead to a buffer overflow, allowing data to be written beyond the intended...

PT-2026-90594

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor – Addons and Templates Kit for Elementor versions prior to 1.7.107 Description The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress allows unauthenticated attackers to extract...

vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling

A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters...

vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling

A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters...

vim security update

9.1.083-9.0.1.el102.20 - Remove upstream references Orabug: 31197557 2:9.1.083-9.20 - RHEL-253668 CVE-2026-28420 buffer overflow in terminal emulator 2:9.1.083-9.19 - RHEL-215660 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes 2:9.1.083-9.18 - RHEL-215683 CVE-2026-59857 vim: stack...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

ASCII smuggling crosses over from AI prompt injection to phishing evasion

In this article 1. What is ASCII smuggling? 2. Writing a practical ASCII-smuggling signature 3. What we observed: ASCII smuggling repurposed for phishing 4. What is known and what is new 5. Is there a detection gap? 6. Mitigation and protection guidance 7. References 8. Learn More Microsoft...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the setcookie method when...

CVE-2026-82701

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82701

A SQL injection vulnerability exists in the Search Functionality of code-projects Online Shopping System 1.0 , specifically in the keyword parameter of /action.php. An unauthenticated remote attacker can manipulate this argument to inject SQL, achieving low impact on confidentiality, integrity, a...

CVE-2026-82701 code-projects Online Shopping System Search Functionality action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

EUVD-2026-68594

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82701 code-projects Online Shopping System Search Functionality action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82701: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

PT-2026-83846

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description An issue exists in the Search Functionality component within the '/action.php' endpoint. Remote manipulation of the keyword argument allows for SQL injection, a technique where...

gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding

A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the IndexFile.checkout and TagReference.create functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to...

CVE-2026-75954 Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause...