RLSA-2026:37282 Important: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack CVE-2026-40622 unbound: Unbound: Denial of...

CVE-2026-64649

A flaw was found in Next.js, a framework for building web applications. A remote attacker can exploit this vulnerability by manipulating Host-associated headers when a Server Action forwards or redirects a request. This can lead to Server-Side Request Forgery SSRF, where the server is tricked int...

CVE-2026-66922 Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

CVE-2026-66922 Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

CVE-2026-66922

Pivotick CVE-2026-66922 affects the tree-layout and cycle-detection code by using plain JavaScript objects as lookup tables indexed with node identifiers that can collide with Object.prototype properties (e.g., constructor, toString, proto ). This can cause inherited-property confusion, wrong typ...

CVE-2026-63303

Summary: CVE-2026-63303 describes a path traversal in Quick.CMS where the URI path component does not normalize ../ sequences, allowing an authenticated admin to read files in the webroot’s sibling directory. Affected product is Quick.CMS (component: URI handling). Underlying cause: failure to no...

RockyLinux 8 : unbound (RLSA-2026:37282)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:37282 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

Linux Distros Unpatched Vulnerability : CVE-2026-17513

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggmlftypetoggmltype of the file ggml/src/ggml.c. The manipulation of the...

RockyLinux 9 : unbound (RLSA-2026:36777)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36777 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

RockyLinux 10 : unbound (RLSA-2026:36320)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36320 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

UBUNTU-CVE-2026-66757

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions ysize and zsize are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value 65535, the...

UBUNTU-CVE-2026-66758

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...

CVE-2026-59921

A flaw was found in Netty's HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly embedded into Content-Disposition MIME headers without any...

EUVD-2026-49322

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astrmainagent.py. The manipulation of the argument req.functool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available an...

CVE-2026-59532 WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

Unauthenticated Other Vulnerability Type in Booking and Rental Manager = 2.7.2 versions...

CVE-2026-59532 WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

Unauthenticated Other Vulnerability Type in Booking and Rental Manager = 2.7.2 versions...

CVE-2026-59532

The CVE concerns the WordPress Booking and Rental Manager plugin for WooCommerce (versions

CVE-2026-17513

A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggmlftypetoggmltype of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through ...

CVE-2026-17513 ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion

A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggmlftypetoggmltype of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through ...

CVE-2026-17513

A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggmlftypetoggmltype of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through ...