ALSA-2026:88316 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer...

CVE-2017-20289: Improper Control of Filename for Include/Require Statement in PHP Program

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

VulnCheck KEV: CVE-2026-84740

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

VulnCheck KEV: CVE-2017-20289

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

Fedora 43 : gnome-shell-extension-gsconnect (2026-eb93fa8f63)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-eb93fa8f63 advisory. Voici les notes de la release, telles que publies par daniellandau le 2026-09-23 : --- Release GSConnect v73 What's Changed Security: fix authenticated path...

Linux Distros Unpatched Vulnerability : CVE-2026-111813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-111804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the...

SUSE SLED15 / SLES15 Security Update : containerd (SUSE-SU-2026:4787-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4787-1 advisory. - CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation bsc1268430. Tenab...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113716 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113716 Source advisory: OSV:GHSA-CW65-GX24-RC82...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-113724 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-113724 Source advisory:...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113724 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113724 Source advisory: OSV:GHSA-43MP-35Q3-X3FQ...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113722 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113722 Source advisory: OSV:GHSA-C978-59M8-C77V...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114144 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114144 Source advisory: MEND:CVE-2026-114144...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114143 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114143 Source advisory: MEND:CVE-2026-114143...

Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Summary Image.merge checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open followed by a load, and IPTC ha...

GHSA-CP9V-662Q-VVX9 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Summary Image.merge checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open followed by a load, and IPTC ha...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114142 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114142 Source advisory: MEND:CVE-2026-114142...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114141 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114141 Source advisory: MEND:CVE-2026-114141...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +2666 more potentially affected by CVE-2026-112402 via pillow (12.3.0)

pillow PYPI version 12.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3d-rcnet =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source...

DEBIAN-CVE-2026-111813

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...