Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2022_5777)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225777 advisory. Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 CVE-2022-2505 Mozilla: Directory indexes for bundled resources reflected URL parameters...

Breaking the Bounded Entanglement Barrier for Quantum Position Verification

Position verification, introduced by Chandran et al. SIAM J. Computing 2014, allows verifiers to test a prover's claimed position by an interactive protocol. Classical position verification is impossible. Even for Quantum Position Verification QPV, there always exists an LOCC Local Operations and...

Classical Verifier Position Verification from Non-Local Games

Secure position verification certifies that a remote prover occupies a claimed location, a task that is provably impossible with classical resources alone against colluding adversaries. Most existing quantum position verification schemes require transmitting quantum states between verifiers and...

DEBIAN-CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

PT-2026-97544

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description A flaw exists in the install-bundle endpoint. When a System Administrator downloads an install bundle for an execution or hop node, the controller signs an X.509 certificate usi...

CVE-2026-88993

The All Bootstrap Blocks WordPress plugin, affecting versions up to and including 1.3.31 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly escape a block attribute before outputting it into an HTML tag-name position . This allows us...

PT-2026-95289

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit versions prior to 9.118.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs vi...

Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w39f-h553-h2mx. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task...

GHSA-CCGQ-FX7H-2V4C Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w39f-h553-h2mx. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task...

CVE-2026-91984

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984

Vikunja before 2.6.0 suffers from a Broken Object-Level Authorization in its task-position endpoints. The application fails to validate that a user-supplied project_view_id belongs to the task's own project, allowing authenticated attackers to insert task position rows into arbitrary other tenant...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

PT-2026-91876

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position button' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-91984: Authorization Bypass Through User-Controlled Key

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

PT-2026-92098

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0 Description Authenticated attackers can insert task position rows into project views belonging to other tenants. This occurs because the application fails to validate that the user-supplied project view id in...