django-oscar-moysklad (>=0.2.0, <=0.2.3), drf-paytm (0.0.1) +3 more potentially affected by CVE-2026-15307 via django (2.1.3)

django PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-oscar-moysklad =0.2.0, =1.4.3, =1.6.5 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

SUSE-SU-2026:3498-1 Security update for rsyslog

This update for rsyslog fixes the following issues: - CVE-2026-61548: parsing of crafted RFC 5424 messages in mmpstrucdata can lead to a stack buffer overflow bsc1272414. - Configuration-dependent issue in the optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd...

CVE-2026-69257

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list...

django-oscar-moysklad (>=0.2.0, <=0.2.3), drf-paytm (0.0.1) +3 more potentially affected by CVE-2026-15830 via django (2.1.3)

django PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-oscar-moysklad =0.2.0, =1.4.3, =1.6.5 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...

Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Summary Flowise's HTTP security module httpSecurity.ts fails to normalize IPv4-mapped IPv6 addresses e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254 before checking them against the deny list. Due to an ipaddr.js kind mismatch ipv6 vs ipv4, all IPv4 CIDR deny rules are silently skipped for...

Malicious code in @qlik/runtime-module-loader (npm)

npm/@qlik/runtime-module-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11803 Malicious code in @qlik/runtime-module-loader (npm)

npm/@qlik/runtime-module-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11885 Malicious code in @servicetitan/lazy-module (npm)

npm/@servicetitan/lazy-module is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/lazy-module (npm)

npm/@servicetitan/lazy-module is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the executeJavaScriptCode function. An attacker can execute arbitrary system commands as root by supplying crafted nodeVMOptions that override default sandbox restrictions,...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the executeJavaScriptCode function. An attacker can execute arbitrary system commands as root by supplying crafted nodeVMOptions that override default sandbox...

CLSA-2026-1784596309 TuxCare security update for ms (1 CVE)

TuxCare rebuilt ms to address 1 CVE. Fixed in 1.0.0-tuxcare.1...

CLSA-2026-1774225208 TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 3.2.6-tuxcare.1...

CLSA-2026-1773360972 TuxCare security update for ms (1 CVE)

TuxCare rebuilt ms to address 1 CVE. Fixed in 0.7.1-tuxcare.1...

CVE-2026-70369

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

CVE-2026-70370

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation...

CVE-2026-70371

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...

CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl

Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...