Security update for vim (important)

openSUSE security update: security update for vim ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21671-1 Rating: important References: bsc1268162 bsc1271684 bsc1275011 bsc1275012 bsc1275013 bsc1275014 bsc1275015 bsc1275016 bsc1275017 bsc1275018...

Debian dsa-6477 : ata-modules-6.12.101+deb13-armmp-di - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6477 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6477-1 [email protected] https://www.debian.org/securit...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001437)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001437 advisory. In the Linux kernel, the following vulnerability has been resolved: ubifs: Set page uptodate in the correct place Page cache reads are lockless, so setting the fresh...

FreeBSD : phpBB -- multiple vulnerabilities (4d06b948-a323-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4d06b948-a323-11f1-a655-3497f65b111b advisory. The phpBB Team reports: Changes since 3.3.16: Improper state verification in OAuth implementation...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001465)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001465 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page sam4k working with Trend Micro Zero Day Initiative reported ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001482)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001482 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async PF workqueue when vCPU is being destroyed Always flush the per-vCPU asyn...

CVE-2026-55779

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

Security Bulletin: Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

Summary Langflow contains two vulnerabilities affecting client-side security and access control integrity. The MarkdownField component renders chat messages using the rehypeRaw plugin without a sanitization pass, causing attacker-controlled LLM response text containing raw HTML to be inserted...

silverstripe/versioned has XSS in archive admin restore

Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin Reporter Steve Boyd Silverstripe Ltd...

GHSA-M4G4-86QC-V8W7 silverstripe/versioned has XSS in archive admin restore

Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin Reporter Steve Boyd Silverstripe Ltd...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

EUVD-2026-68015

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

CVE-2026-55779

Silverstripe Versioned (a versioning module for Silverstripe CMS) contains a stored XSS in RestoreAction::getRestoreMessage() (src/RestoreAction.php). The method builds ArchiveAdmin restore notifications rendered as CAST_HTML but inserts $restoredItem->Title, $restoredItem->URLSegment, $res...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

copyfail-poc

Copy Fail · CVE-2026-31431 Local privilege escalation on Linu...

EUVD-2026-66296

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands. The same statement disclosed that forensic work had found further data outflows i...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)

Summary IBM DataPower Gateway affected by cross-site scripting due to DOMPurify CVE-2026-66010 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...

GHSA-F2XF-7X3G-4272 PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Summary Stored cross-site scripting XSS in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new...