[SECURITY] Fedora 43 Update: antlr4-project-4.13.2-14.fc43

ANTLR ANother Tool for Language Recognition is a powerful parser generator for reading, processing, executing, or translating structured text or binary files. It is widely used to build languages, tools, and frameworks. From a grammar, ANTLR generates a parser that can build and walk parse trees...

[SECURITY] Fedora 43 Update: spoofdpi-1.5.3-2.fc43

Simple and fast anti-censorship tool written in Go...

[SECURITY] Fedora 43 Update: ruby-3.4.10-31.fc43

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

[SECURITY] Fedora 44 Update: ruby-4.0.6-36.fc44

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

GHSA-56R5-2P2F-7CXP PocketSphinx: Buffer overflows in language and acoustic model loading code

Impact The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

GO-2026-5981 Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0

Ech0: ParseAcceptLanguage separator bypass enables 70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0...

GO-2026-5966 File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser

File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser...

CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

CVE-2026-8297

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

EUVD-2026-41914

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read...

EUVD-2026-18522

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models...

CVE-2026-9586 Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

CVE-2026-8297

CVE-2026-8297 describes an SQL injection in GisLab Laboratory Management System by Gis Informatics Engineering Consulting (Gis Informatics). Affected versions: 1.4.03 through 08072026. The issue is a generic SQL injection vulnerability with network attack vector, no user interaction, and no privi...

CVE-2026-63094

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-51080

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity XXE vulnerability...

CVE-2026-41850

A flaw was found in Spring Framework. Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. A remote attacker can exploit this by providing a specially crafted expression, which triggers excessive resource...

SUSE-SU-2026:3102-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues - Update to version go1.26.5 bsc1255111. - CVE-2026-27145: crypto/x509: split candidate hostname only once bsc1267450. - CVE-2026-39822: os: Root escape via symlink plus trailing slash bsc1271014. - CVE-2026-42504: mime: quadratic complexi...

SUSE CVE-2026-57074

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parsercparse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer. Truncated strings such as "a/" can trigger an out-of-bounds read...

SUSE-SU-2026:3098-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...