CVE-2026-72143 platform/x86: ISST: Restore SST-PP control to all domains

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Restore SST-PP control to all domains The SST-PP control offset is only restored to power domain 0 after resume. During suspend, control values are read and stored for all power domains. Use pdinfo-sstbase...

PT-2026-72606

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A regression in the netfilter component causes packets for valid connections to be dropped when using connlimit for soft-limiting scenarios. This occurs when a new connection reuses a...

Oracle Linux 8 : dracut (ELSA-2026-54575)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-54575 advisory. 049-246.git20260728.0.1 - Refactor getucodefile Orabug: 36989953 - Revert the fixes for bugs 33676753 and 33888951 due to regressions Orabug: 35656614 - Fix ty...

CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

EUVD-2026-58653

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859: Incorrect Authorization

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

dracut security update

049-246.git20260728.0.1 - Refactor getucodefile Orabug: 36989953 - Revert the fixes for bugs 33676753 and 33888951 due to regressions Orabug: 35656614 - Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch Orabug: 35268918 - Enable the code to create ifcfg file Orabug:...

Does Fixing Break Security? an Empirical Study of Security Degradation in Iterative LLM-Driven Infrastructure-As-Code Repair

Background: Iterative feedback loops are the dominant paradigm for improving LLM-generated Infrastructure-as-Code IaC: validators such as Checkov and terraform validate feed error signals back for successive repair attempts. Prior work reports cumulative-best metrics, which are non-decreasing by...

CVE-2026-16253 Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...

postgis:gserialized_from_bytea_fuzzer: Crash in gserialized2_from_lwgeom_any

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed Report: https://oss-fuzz.com/testcase?key=5672880541859840 Project: postgis Fuzzing Engine: libFuzzer Fuzz Target: gserializedfrombyteafuzzer Job Type: libfuzzerubsanpostgis Platform Id: linux Crash Type: UNKNOWN READ Crash Address...

postgis:gserialized_from_bytea_fuzzer: Heap-buffer-overflow in gserialized2_validate_nurbs

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed Report: https://oss-fuzz.com/testcase?key=5123821921959936 Project: postgis Fuzzing Engine: libFuzzer Fuzz Target: gserializedfrombyteafuzzer Job Type: libfuzzerasanpostgis Platform Id: linux Crash Type: Heap-buffer-overflow READ 8...

CVE-2026-68296

In the Linux kernel, the following vulnerability has been resolved: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM Before commit 00d066a4d4ed "netdevfeatures: convert NETIFFLLTX to dev-lltx", NETIFFLLTX was set unconditionally in both gretunnelinit and ip6gretnlinitfeatures alongside...

EUVD-2026-54377

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

RLSA-2026:49871 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID while holding VMA lock CVE-2026-23199 Bug Fixes...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

vlc:vlc-demux-dec-libfuzzer-ty: Heap-buffer-overflow in check_sync_pes

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=6354530425176064 Project: vlc Fuzzing Engine: libFuzzer Fuzz Target: vlc-demux-dec-libfuzzer-ty Job Type: libfuzzerasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash Address:...

Oracle Linux 9 : p11-kit (ELSA-2026-49667)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49667 advisory. 0.26.2-1 - Rebase to 0.26.2 Resolves: RHEL-147825 0.26.1-1 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 0.25.10-1 - Update to new upstrea...

Low: Red Hat Bug Fix Advisory: httpd bug fix and enhancement update

An update for httpd is now available for Red Hat Enterprise Linux 10. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Bug Fixes and Enhancements: modproxyhtml regression in CVE-2026-34355 fix JIRA:RHEL-192750...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...