pcs security update

An update is available for pcs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The pcs packages provide a command-line configuration system for the Pacemaker an...

CVE-2026-113357

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

BIT-PARSE-2026-109954 Parse Server 9.0.0 before 9.10.2 Transactional Batch Request Write Interference

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients'...

EUVD-2026-104928

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

CVE-2026-85267 Cross-Site WebSocket Hijacking in Google Cloud Shell

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched...

CVE-2026-85267

A Cross-Site WebSocket Hijacking vulnerability exists in Google Cloud Shell on Google Cloud Platform (prior to 2026-07-22). The root cause is missing origin validation in WebSockets (CWE-1385), which allows an unauthenticated attacker to hijack an active Cloud Shell session via a cross-origin Web...

Server-Side Request Forgery

Apache Camel is vulnerable to Server-Side Request Forgery. The vulnerability is due to the AS2 component taking the MDN destination address from the inbound message without validation, where it uses that address as the destination for the outgoing receipt and a remote partner can supply an...

TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032...

CVE-2026-17518

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section ...

CVE-2026-17518

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section ...

CVE-2026-17518

Certain ASUS router models are vulnerable to a buffer copy without checking the size of input . This flaw allows an adjacent authenticated user to send an HTTP request with input exceeding the expected length, potentially leading to corrupted device operations or a denial of service (DoS) . Remed...

EUVD-2026-104783

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section ...

CLEANSTART-2026-UN12409 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-NF66444 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-FA98091 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

EUVD-2026-104637

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

Oracle E-Business Suite: CVE-2026-101701: Critical Patch Update

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: Request Submission and Scheduling. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracl...

Alibaba Cloud Linux 3 : 0307: libevent (ALINUX3-SA-2026:0307)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0307 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-63382: Libevent is an event...

Apache Tomcat 10.1.55 < 10.1.61 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.61. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.61security-10 advisory. - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was...

Apache Tomcat 9.0.118 < 9.0.123 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.123. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.123security-9 advisory. - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was...