CVE-2026-74848 Apache APISIX: Cross-user response poisoning in serverless plugins

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

CVE-2026-74848 Apache APISIX: Cross-user response poisoning in serverless plugins

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

CVE-2026-81719: Improper Control of Generation of Code

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

PT-2026-82602

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software uses a denylist to identify trusted built-in plugins, which allows unsigned plugins located in top-level plugins/ directories and unknown subdirectories to bypass signature...

PT-2026-85197

openssl encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

CVE-2026-81700: Improper Verification of Cryptographic Signature

opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...

MiracleLinux 8 : gstreamer1-plugins-good-1.16.1-7.el8_10.3 (AXSA:2026-1676:05)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1676:05 advisory. gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders CVE-2026-18649 gstreamer1-plugins-good...

Security update for gstreamer-plugins-bad (moderate)

openSUSE security update: security update for gstreamer-plugins-bad ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21629-1 Rating: moderate References: bsc1268394 Cross-References: CVE-2026-52718 CVSS scores: CVE-2026-52718 SUSE : 6.5...

RLSA-2026:59972 Important: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gstreamer: GStreamer: Remote Code Execution via...

gstreamer1-plugins-good security update

An update is available for gstreamer1-plugins-good. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...

CVE-2026-54606

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

RHSA-2026:59487 Red Hat Security Advisory: gstreamer1-plugins-base security update

Bulletin has no description...

gstreamer1-plugins-base security update

An update is available for gstreamer1-plugins-base. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer-plugins-base (UTSA-2026-093188)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093188 advisory. GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags. Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : gstreamer1-plugins-bad-free-1.16.1-9.el8_10.2 (AXSA:2026-1664:05)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1664:05 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 Tenable has extracted the...

ALSA-2026:59972 Important: gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gstreamer: GStreamer: Remote Code Execution via...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer-plugins-good (UTSA-2026-093155)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093155 advisory. The gstaacparsesinksetcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of...

RHEL 10 : gstreamer1-plugins-good (RHSA-2026:59972)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59972 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a...

RockyLinux 10 : gstreamer1-plugins-good (RLSA-2026:59972)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:59972 advisory. gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay CVE-2026-18299 Tenable has extracted the preceding description block directly from...

AlmaLinux 9 : gstreamer1-plugins-good (ALSA-2026:59152)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:59152 advisory. gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow CVE-2026-18296 gstreamer: GStreamer: Remote code execution vi...