CVE-2026-67527 OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-67527

OpenProject prior to v17.6.0 is affected by an improper access control vulnerability in PATCH /api/v3/work_packages/{id} via the _links.fileLinks parameter.Authenticated users with edit_work_packages but without manage_file_links could resolve Storages::FileLink records by raw id, detach or hard-...

EUVD-2026-51280

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

SUSE CVE-2026-54070

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only...

RHSA-2026:47932 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:47930 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:47915 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:47892 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:47618 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHSA-2026:45779 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHSA-2026:40486 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHSA-2026:37767 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHSA-2026:36872 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHSA-2026:34854 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than...

Linux Distros Unpatched Vulnerability : CVE-2026-17724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-17938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in FullScreen in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTM...

Linux Distros Unpatched Vulnerability : CVE-2026-56850

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across request...

Linux Distros Unpatched Vulnerability : CVE-2026-17776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a...

Linux Distros Unpatched Vulnerability : CVE-2026-17781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to...