Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.68 packages and security update

Red Hat OpenShift Container Platform release 4.14.68 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

CVE-2026-13454

creationtimestamp| type| source ---|---|--- 2026-07-01 10:51:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpldwfzwlj2q 2026-07-01 11:40:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplgoh6jhd2h 2026-07-01 12:39:40+00:00| seen|...

CVE-2026-11794

creationtimestamp| type| source ---|---|--- 2026-07-01 09:51:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplakrdvmc2d 2026-07-01 11:45:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplgxz7v4x23...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-56016

creationtimestamp| type| source ---|---|--- 2026-07-01 09:17:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpl6nzkpfa2o 2026-07-01 17:06:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mplyvlt3kg2f...

CVE-2026-13733

creationtimestamp| type| source ---|---|--- 2026-07-01 09:16:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpl6mcgcha2o 2026-07-01 09:16:13+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpl6md3emm2g 2026-07-01 11:16:06+00:00| seen|...

CVE-2025-15666

A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombiner::Copy of the file code/Common/SceneCombiner.cpp of the component Model File Handler. Such manipulation of the argument width/height lead...

CVE-2026-12575

DVP80ES3 with Improper Resource Shutdown or Release vulnerability...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the process that handles user requests without proper validation of request origin. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into submitting...

BELL-CVE-2026-53290

Bulletin has no description...

CVE-2026-7839

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpyssavedpassword, 64,...

CVE-2026-20462

creationtimestamp| type| source ---|---|--- 2026-07-01 05:09:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpkqssa4si2l 2026-07-02 06:24:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnfi5dbuk2u 2026-07-02 19:16:31+00:00| seen|...

CVE-2026-14191

creationtimestamp| type| source ---|---|--- 2026-07-01 05:01:30+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpkqeufzqj27 2026-07-02 01:05:20+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mpmtnhgzbd2h 2026-07-02 13:09:39+00:00| seen|...

EUVD-2026-40890

The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the...

EUVD-2026-40887

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsportseasongroupdel AJAX handler, which only...

CVE-2026-7839 UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpyssavedpassword, 64,...

SUSE CVE-2026-53404

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from...

SUSE CVE-2026-53532

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exrstartread on untrusted input...

CVE-2026-43709

creationtimestamp| type| source ---|---|--- 2026-07-01 02:51:39+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:00:59+00:00| seen| https://www.thezdi.com/blog/2026/6/30/the-june-2026-apple-security-update-review 2026-07-02 01:00:43+00:00| seen|...

CVE-2026-53181

creationtimestamp| type| source ---|---|--- 2026-07-01 02:48:11+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0812 2026-07-06 06:50:05+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-09-15 12:46:43+00:00| seen|...