[SECURITY] Fedora 43 Update: dotnet8.0-8.0.129-2.fc43

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 44 Update: dotnet8.0-8.0.129-2.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 44 Update: dotnet9.0-9.0.119-1.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

PT-2026-64342

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Certain platform drivers handling core ACPI devices fail to verify the presence of a device's ACPI companion object during the probe process. Because device match driver override can for...

PT-2026-71915

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.24 Description An issue exists where the endpoint "/api/public/v1/roles/assign" calls the validateGlobalRoleUpdate function without verifying the appBuilder.appId or role.appId variables. This allows an app-scop...

ROS-20260724-73-0018

The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

Rockwell FactoryTalk Services Platform 6.60 Authentication Bypass (SD1786)

The version of Rockwell FactoryTalk Services Platform installed on the remote Windows host is 6.60. It is, therefore, affected by an authentication bypass vulnerability: - A vulnerability exists that allows an attacker to bypass JWT signature validation during Okta Web Authentication. The...

CVE-2026-56444 affecting package unbound for versions less than 1.25.2-1

CVE-2026-56444 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-44690 affecting package unbound for versions less than 1.25.2-1

CVE-2026-44690 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-44687 affecting package unbound for versions less than 1.25.2-1

CVE-2026-44687 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48012 Shopware SSO referer trust leading to an arbitrary redirect target

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

CVE-2026-65705

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinitfilter 0. When configinput allocates the...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update

Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image. Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal as a bootable...

CVE-2026-65698 Void 1.3.4 Path Traversal via AI Agent File-Reading Tools

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

CVE-2026-65687

creationtimestamp| type| source ---|---|--- 2026-07-23 15:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd472v7uj2j 2026-07-23 17:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdcvfs6bk2m 2026-07-29 22:37:06+00:00| seen|...

USN-8600-1: libXpm vulnerability

Naoki Wakamatsu discovered that libXpm did not properly validate file boundaries when processing XPM image files. An attacker could possibly use this issue to cause libXpm to crash, resulting in a denial of service...

GHSA-XVCM-6775-5M9R vulnerabilities

Vulnerabilities for packages: vitess, nextcloud-server, rancher-api-ui...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.94 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.94 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

PYSEC-2026-3525 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

Affected: praisonai-platform PyPI CWE-287 Improper Authentication Overview GHSA-3qg8-5g3r-79v5 Critical reported that praisonai-platform's JWT signing secret defaulted to the hardcoded literal "dev-secret-change-me", and that the production guard meant to prevent this was default-open it only...