52985 matches found
CLSA-2026-1791344648 Fix CVE(s): CVE-2026-8458
SECURITY UPDATE: wrong connection reuse for different Negotiate services - debian/patches/CVE-2026-8458.patch: store the proxy service name on the connection and only reuse a connection when the same service names are asked for in lib/url.c, lib/urldata.h and lib/httpnegotiate.c. - CVE-2026-8458...
Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Important: Red Hat Security Advisory: openssh security update
An update for openssh is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
PT-2026-107420
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...
CVE-2026-97354: Server-Side Request Forgery (SSRF)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...
CVE-2026-107121: Cleartext Transmission of Sensitive Information
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...
PT-2026-107545
Name of the Vulnerable Software and Affected Versions @backstage/plugin-kubernetes-backend versions prior to 0.21.8 Description Improper entity validation in a deprecated Kubernetes services endpoint allows an authenticated user with Kubernetes read permissions to access workload data beyond thei...
CVE-2026-104046
A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...
firefox: thunderbird: Privilege escalation in the DLL Services component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DLL Services component...
CVE-2026-89430
Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...
CVE-2026-102159
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services...
CVE-2026-101156
A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...
CVE-2026-101027
When migrations ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...
firefox: thunderbird: Privilege escalation in the DLL Services component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DLL Services component...
CVE-2026-101157 Security Advisory 0192
A stored cross-site scripting XSS vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated...
CVE-2026-101157
A stored cross-site scripting (XSS) vulnerability exists that may allow an unauthenticated attacker with adjacent-network access to inject malicious content. This content executes when an authenticated user views the affected content, potentially allowing the attacker to compromise the victim's a...
CVE-2026-101156 Security Advisory 0192
A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...
CVE-2026-101156
A stored cross-site scripting (XSS) vulnerability exists in the affected system, potentially allowing an authenticated, high-privilege administrator to inject malicious content into a configuration. This content can execute in the browser of another authenticated user when they view or compare th...
EUVD-2026-93960
A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...
CVE-2026-102159 Security Advisory 0190
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services...