AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink

Summary The fix for CVE-2026-33482 GHSA-pmj8-r2j7-xg6c is incomplete. That advisory reported that sanitizeFFmpegCommand plugin/API/standAlone/functions.php failed to strip $... command substitution, allowing OS command injection at the execAsync sh -c sink. The fix commit 25c8ab90 added $, , , , ...

GHSA-WC3F-XC32-435F AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink

Summary The fix for CVE-2026-33482 GHSA-pmj8-r2j7-xg6c is incomplete. That advisory reported that sanitizeFFmpegCommand plugin/API/standAlone/functions.php failed to strip $... command substitution, allowing OS command injection at the execAsync sh -c sink. The fix commit 25c8ab90 added $, , , , ...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

The vulnerability CVE-2026-10609 affects the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, enabling a delegated editor to exfiltrate...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

OPENSUSE-SU-2026:21154-1 Security update for ofono

This update for ofono fixes the following issues: Changes in ofono: - Reference the tracking bugs for the SMS/STK/USSD decoder security fixes applied upstream across the 2.14-2.17 updates: SMS decoder stack buffer overflows: CVE-2023-2794 boo1218292, CVE-2023-4232 boo1218293, CVE-2023-4233...

GHSA-VJHF-6XFR-5P9G vulnerabilities

Vulnerabilities for packages: virt-operator-fips, harvester-fips, virt-controller-fips, harvester, virt-operator, virt-launcher...

CVE-2024-33394 vulnerabilities

Vulnerabilities for packages: virt-operator-fips, harvester-fips, virt-controller-fips, harvester, virt-operator, virt-launcher...

CVE-2025-14525 vulnerabilities

Vulnerabilities for packages: virt-operator-fips, harvester-fips, virt-controller-fips, harvester, virt-handler, virt-launcher...

GHSA-4Q63-MR2M-57HF vulnerabilities

Vulnerabilities for packages: virt-operator-fips, harvester-fips, virt-controller-fips, harvester, virt-operator, virt-launcher...

GHSA-25MH-HP8X-CGRV vulnerabilities

Vulnerabilities for packages: virt-operator-fips, harvester-fips, virt-controller-fips, harvester, virt-handler, virt-launcher...

CVE-2024-31420 vulnerabilities

Vulnerabilities for packages: virt-operator-fips, harvester-fips, virt-controller-fips, harvester, virt-operator, virt-launcher...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, ruby4.0-rails, pact-broker-docker-fips, logstash-fips, ruby3.2-rails, logstash, gitlab-rails-ce, ruby3.3-rails, kube-logging-operator...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, ruby4.0-rails, pact-broker-docker-fips, logstash-fips, ruby3.2-rails, logstash, gitlab-rails-ce, ruby3.3-rails, kube-logging-operator...

GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, ruby4.0-rails, pact-broker-docker-fips, logstash-fips, ruby3.2-rails, logstash, gitlab-rails-ce, ruby3.3-rails, kube-logging-operator...

GHSA-6WX8-W4F5-WWCR vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-fluentd-kubernetes-daemonset, ruby4.0-rails, logstash-fips, ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, kube-fluentd-operator, ruby3.3-rails, kube-logging-operator,...

GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-fluentd-kubernetes-daemonset, ruby4.0-rails, logstash-fips, ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, kube-fluentd-operator, ruby3.3-rails, kube-logging-operator,...

GHSA-WV3X-4VXV-WHPP vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-fluentd-kubernetes-daemonset, ruby4.0-rails, logstash-fips, ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, kube-fluentd-operator, ruby3.3-rails, kube-logging-operator,...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-fluentd-kubernetes-daemonset, ruby4.0-rails, logstash-fips, ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, kube-fluentd-operator, ruby3.3-rails, kube-logging-operator,...