Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ACPI: Video – Fix for a use-after-free in acpivideoswitchbrightness The switchbrightnesswork delayed work accesses device-brightness and device-backlight, which were freed by acpivideodevunregisterbacklight during device removal...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the notify server process. An attacker can disrupt the lifecycle management of co-located virtual machines by sending forged domain lifecycle events through a legitimate Unix socket after gaining shell access...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the notify server process. An attacker can disrupt the lifecycle management of co-located virtual machines by sending forged domain lifecycle events through a legitimate Unix socket after gaining shell access...

CVE-2026-49261

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

tigervnc security update

1.15.0-7.1 - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities Resolves: RHEL-163213 Resolves: RHEL-163281 Resolves: RHEL-163267 - Fix CVE-2026-34352 Resolves: RHEL-167986 1.15.0-7 - Fix CVE-2025-62229:...

PT-2026-56598

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.6 Wireshark versions 4.4.0 through 4.4.16 Description A crash in the FMP/NOTIFY protocol dissector allows a denial of service. Recommendations Update Wireshark versions 4.6.0 through 4.6.6 to a newer versio...

CVE-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrepnotifycmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in...

CVE-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrepnotifycmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in...

CVE-2026-49261

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrepnotifycmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in...

mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

OPENSUSE-SU-2026:20933-1 Security update for mariadb

This update for mariadb fixes the following issues Update to 11.8.8: - CVE-2026-3494: audit plugin comment handling bypass bsc1259176. - CVE-2026-34303: mysql: optimizer unspecified vulnerability bsc1266435. - CVE-2026-35549: SHA2 auth plugin crash on large packets bsc1261413. - CVE-2026-44168:...

SUSE-SU-2026:22095-1 Security update for mariadb

This update for mariadb fixes the following issues Update to 11.8.8: - CVE-2026-3494: audit plugin comment handling bypass bsc1259176. - CVE-2026-34303: mysql: optimizer unspecified vulnerability bsc1266435. - CVE-2026-35549: SHA2 auth plugin crash on large packets bsc1261413. - CVE-2026-44168:...

SUSE-SU-2026:2330-1 Security update for mariadb

This update for mariadb fixes the following issues: - CVE-2026-3494: audit plugin comment handling bypass bsc1259176. - CVE-2026-34303: mysql: optimizer unspecified vulnerability bsc1266435. - CVE-2026-35549: SHA2 auth plugin crash on large packets bsc1261413. - CVE-2026-44168: wsrep SST unsafe...

at.molindo:molindo-notify (>=1.0.0-alpha-3, <=2.0.0), com.blitline:blitline-image-client-example (>=0.10.1, <=0.13.3) +129 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.0.4.release)

org.springframework:spring-core MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - at.molindo:molindo-notify =1.0.0-alpha-3, =0.10.1, =0.10.1, =0.9.0, =1.2.1, =1.2.0, =1.0....

CVE-2026-8425

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to ...

CVE-2026-5229

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This is due to the plugin trusting user-controlled cookie data to determine which WordPress account to authenticate after a LINE OAuth login. When LINE doesn't provide an email...

Security update for mariadb

This update for mariadb fixes the following issues: CVE-2026-3494: audit plugin comment handling bypass bsc1259176. CVE-2026-34303: mysql: optimizer unspecified vulnerability bsc1266435. CVE-2026-44168: wsrep SST unsafe parameter handling on the donor side bsc1266442. CVE-2026-44170: argument...

CLSA-2026-1780508058 bind: Fix of CVE-2026-5946

CVE-2026-5946: fix non-IN class request handling - disable recursion, UPDATE, and NOTIFY for non-IN views; reject meta-classes ANY/NONE in UPDATE/NOTIFY; validate message CLASS early; skip deny-answer-address for non-IN...

caluma (5.6.0), django-covid19 (>=0.3.0a0, <=0.4.0b1) +6 more potentially affected by CVE-2026-8404 via django (2.2.12)

django PYPI version 2.2.12 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma 5.6.0 - django-covid19 =0.3.0a0, =0.2.1, =2.2.2, =0.9.7, =0.1.3, =0.30.7 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

CLSA-2026-1780476189 Fix CVE(s): CVE-2026-5946

SECURITY UPDATE: restrict DNS operations recursion, UPDATE, NOTIFY to class IN only - debian/patches/CVE-2026-5946.patch: restrict DNS operations recursion, UPDATE, NOTIFY to class IN only - CVE-2026-5946...