Important Photon OS Security Update - PHSA-2026-5.0-0827

Updates of 'python3-ujson', 'jq' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2026-3505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all pg...

[SECURITY] Fedora 44 Update: kf6-kpackage-6.25.0-1.fc44

KDE Frameworks 6 Tier 2 library to load and install non-binary packages as if they were plugins...

@paperclipai/server (>=2026.3.17-canary.2, <=2026.415.0-canary.7), companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3) +4 more potentially affected by unknown CVE via @paperclipai/db (>=2026.3.17-canary.2, <=2026.415.0-canary.7)

@paperclipai/db NPM version =2026.3.17-canary.2, =2026.3.17-canary.2, =2026.324.0-canary.0, =2026.3.17-canary.3, =0.6.5, =0.6.6 Source cves: unknown CVE Source advisory: SNYK:JS-PAPERCLIPAIDB-16421449...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.73.0), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.72.2) +8 more potentially affected by CVE-2026-41427 via @better-auth/oauth-provider (1.5.5)

@better-auth/oauth-provider NPM version 1.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260410224321...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @42zeroo/tescik (>=1.0.0, <=1.1.1963) +708 more potentially affected by CVE-2026-41242 via protobufjs (8.0.0)

protobufjs NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs and may be impacted: - @0xchain/telemetry =1.1.0-beta.8, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 - @adaptic/backend-legacy 0.0.941 and more...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3346 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...

3m (>=0.1.0, <=0.1.3), a2d-diary (>=0.1.0, <=0.1.5) +1789 more potentially affected by CVE-2026-41312 via pypdf2 (>=1.24.0, <=3.0.1)

pypdf2 PYPI version =1.24.0, =0.1.0, =0.1.0, =1.1.0, =0.1.32, =0.0.0.1, =0.0.1.44, =0.0.1, =0.2.2.716, =0.1.4, =1.0.3, =0.1.3, =0.2.0, =0.4.2 - adame 0.2.2 and more Source cves: CVE-2026-41312 Source advisory: SNYK:PYTHON-PYPDF2-16097902...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: pytest: python3-pytest-9.0.3-1.hum1 noarch pytest-9.0.3-1.hum1.src src...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jq: jq-1.8.1-3.hum1 aarch64, x8664 jq-devel-1.8.1-3.hum1 aarch64, x8664 jq-1.8.1-3.hum1.src src...

@aumoai/mcp-data-analyst (>=0.1.0, <=0.2.8), @geobio/code_execution_server (>=0.2.0, <=0.2.1) +35 more potentially affected by CVE-2026-39313 via mcp-framework (>=0.1.27, <=0.2.15)

mcp-framework NPM version =0.1.27, =0.1.0, =0.2.0, =1.0.11, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves: CVE-2026-39313 Source advisory: OSV:GHSA-353C-V8X9-V7C3...

Critical: Red Hat Security Advisory: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3 is now available. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +735 more potentially affected by CVE-2026-6414 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0-beta.23, =1.0.3 and more Source cves: CVE-2026-6414 Source advisory: SNYK:JS-FASTIFYSTATIC-16098210...

EUVD-2026-23223

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-3489

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-3489 DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-3489

The CVE-2026-3489 entry concerns the DirectoryPress WordPress plugin (Business Directory and Classified Ad Listing) with vulnerable versions up to 3.6.26. The issue is an SQL Injection via the 'packages' parameter caused by insufficient escaping of user input and inadequate SQL query preparation,...

CVE-2026-3489

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-3489 DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.65 packages and security update

Red Hat OpenShift Container Platform release 4.13.65 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...