SUSE-SU-2026:3490-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: - CVE-2025-24912: hostapd RADIUS authentication of wi-fi devices allows a user in between the hostapd and the RADIUS server to inject crafted RADIUS packets and force RADIUS authentications to fail bsc1239461. - Missing network context...

email-master (0.6.2), hnzhu010506 (0.0.1) +2 more potentially affected by CVE-2026-69249 via cryptography (37.0.0)

cryptography PYPI version 37.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - email-master 0.6.2 - hnzhu010506 0.0.1 - hnzhu010507 =0.0.1, =0.0.8 - kadi 0.24.0 Source cves: CVE-2026-69249 Source advisory:...

CVE-2026-14824

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

EUVD-2026-52585

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-14824 Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-14824

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-14824

The Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.2.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape a question setting before it is outputted into an unquoted HTML attribute . This allows users with contributor-lev...

CVE-2026-14824 Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the node:zlib synchronous APIs when a spoofed TypedArray byteLength triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the StatementSyncIterator. An attacker can execute unintended SQL statements with altered parameters by leveraging a stale iterator after the underlying statement has been reset and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits. Remediation A fix was...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the dns.resolveAny function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DN...

RockyLinux 8 : kernel-rt (RLSA-2026:49213)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49213 advisory. kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack...

PT-2026-67648

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-14824: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

SUSE CVE-2026-17347

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17347

A flaw was found in pgAdmin 4. The MASTERPASSWORDHOOK setting, which allows administrators to configure an external command for per-user encryption keys, improperly substitutes usernames into the command string. An authenticated user can exploit this by providing a specially crafted username...

WordPress Quiz and Survey Master (QSM) plugin < 11.1.3 - Unauthenticated User Enumeration and Password Oracle vulnerability

Unauthenticated User Enumeration and Password Oracle vulnerability discovered by Ahmad Mubarak Alanazi in WordPress Plugin Quiz And Survey Master versions 11.1.3...

kernel: netfilter: ctnetlink: ensure safe access to master conntrack

A flaw was found in the netfilter: ctnetlink component of the Linux kernel. This vulnerability occurs due to insufficient locking when accessing the master conntrack object, allowing it to become invalid while still being referenced. A local attacker could potentially exploit this race condition,...

kernel: netfilter: ctnetlink: ensure safe access to master conntrack

A flaw was found in the netfilter: ctnetlink component of the Linux kernel. This vulnerability occurs due to insufficient locking when accessing the master conntrack object, allowing it to become invalid while still being referenced. A local attacker could potentially exploit this race condition,...