CVE-2026-54087

EasyAdmin (easycorp/easyadmin-bundle), a Symfony admin generator, is vulnerable to stored XSS in versions 5.0.0 through 5.0.12 . The root cause is that FileField and ImageField accept browser-executable uploads by default (HTML and SVG respectively), and when the upload directory resides in the p...

CVE-2026-54087 EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or...

CVE-2026-54087 EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or...

CVE-2026-46696

CVE-2026-46696 affects October CMS (system module) versions prior to 3.7.17 and 4.2.21 . A chained bypass in the Twig sandbox security policy occurs when cms.safe_mode is enabled: the Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through ...

CVE-2025-24890

A flaw was found in gix-sec. On Windows, an elevated administrator running a program that uses gix-sec may incorrectly trust repositories controlled by another user. This bypasses security protections, allowing repository configurations or hooks to execute commands with the administrator's...

OESA-2026-3870 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A TOCTOU Time-of-Chec...

OESA-2026-3850 kata-containers-go security update

This is core component of Kata Container, to make it work, you need a isulad/docker engine. Security Fixes: A flaw was found in Kata Containers, affecting both its Rust and Go runtimes. An authenticated pod user can exploit this by setting the io.katacontainers.configpath annotation to an arbitra...

OESA-2026-3842 thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.CVE-2026-84119 Use-after-free in the...

OESA-2026-3832 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...

OESA-2026-3808 pcp security update

Performance Co-Pilot PCP provides a framework and services to support system-level performance monitoring and performance management. Security Fixes: A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed...

OESA-2026-3809 pcp security update

Performance Co-Pilot PCP provides a framework and services to support system-level performance monitoring and performance management. Security Fixes: A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed...

OESA-2026-3807 pcp security update

Performance Co-Pilot PCP provides a framework and services to support system-level performance monitoring and performance management. Security Fixes: A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed...

OESA-2026-3791 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global mozdebugprefix /lib/debug %global mozdebugdir /lib/debug/ %global unamem %uname -m %global symbolsfilename -.en-US.-%uname.crashreporter-symbols.zip %global symbolsfilepath...

OESA-2026-3790 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global mozdebugprefix /lib/debug %global mozdebugdir /lib/debug/ %global unamem %uname -m %global symbolsfilename -.en-US.-%uname.crashreporter-symbols.zip %global symbolsfilepath...

OESA-2026-3789 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global mozdebugprefix /lib/debug %global mozdebugdir /lib/debug/ %global unamem %uname -m %global symbolsfilename -.en-US.-%uname.crashreporter-symbols.zip %global symbolsfilepath...

OESA-2026-3744 systemd security update

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. Security Fixes: systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on...

OESA-2026-3742 systemd security update

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. Security Fixes: systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on...

OESA-2026-3743 systemd security update

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. Security Fixes: systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on...

OESA-2026-3736 sudo security update

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Sudo through 1.9.17p2 fails to apply intercept policy checks ...

OESA-2026-3723 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privilege...