RHSA-2026:1959 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-eventlet) security update

Bulletin has no description...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a attacker to perform XSS attacks.

The vulnerability of the Cisco Identity Services Engine ISE web interface relates to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (python-eventlet) (RHSA-2026:1959)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:1959 advisory. Eventlet is a networking library written in Python. It achieves high scalability by using non-blocking io while at the same time retaining high...

PT-2026-25758

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.0 Description The software does not properly normalize IPv4-mapped IPv6 addresses before validating reserved IP...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC), a virtual device for collecting user authentication data, allows attackers to carry out XSS attacks.

The vulnerability of the Cisco Identity Services Engine ISE web interface and the Cisco ISE Passive Identity Connector ISE-PIC virtual authentication data collection device is related to the failure to implement measures to neutralize HTML tags. Exploiting this vulnerability allows a malicious...

CVE-2026-1356

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::loadimagesource function. This makes it possible for unauthenticated attackers to make web requests...

CVE-2026-1507

The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service...

Realtek IIS Codec Service 代码问题漏洞

The Realtek IIS Codec Service is a backend service for audio decoders provided by Realtek Semiconductor in China. Version 6.4.10041.133 of the Realtek IIS Codec Service contains a code vulnerability. This vulnerability stems from the lack of quotation marks around the service path, which may allo...

Linux Distros Unpatched Vulnerability : CVE-2025-12575

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain...

PT-2026-7833

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load image source function. This makes it possible for unauthenticated attackers to make web reques...

GitLab 18.0 < 18.6.6 / 18.7 < 18.7.4 / 18.8 < 18.8.4 (CVE-2025-12575)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticate...

openSUSE 16 Security Update : tailscale (openSUSE-SU-2026:20192-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20192-1 advisory. Changes in tailscale: - Update to version 1.94.0: IS SET and NOT SET have been added as device posture operators India DERP Region City Name...

GHSA-GF3V-FWQG-4VH7 @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation

Description The RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option enabled by default is intended to restrict crawling to the same site as the base URL. The implementation used String.startsWith to compar...

CVE-2025-8668

CVE-2025-8668 describes an Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in E-Kalite Turboard software. The issue permits Reflected XSS via input that is not properly sanitized during page generation. Affected timeframe: Turboard from 2025.07 through 11022026. Th...

CVE-2025-57709

The CVE-2025-57709 issue affects Qsync Central. A buffer overflow in Qsync Central (prior to version 5.0.0.4) can allow a remote attacker with a valid user account to modify memory or crash processes. The fixed version is Qsync Central 5.0.0.4 (2026-01-20) and later. Affected scope includes Qsync...

CVE-2025-12575

GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user with certain permissions to make unauthorized requests to internal network services throug...

UBUNTU-CVE-2025-12575

GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user with certain permissions to make unauthorized requests to internal network services throug...

CVE-2025-12073

GitLab CVE-2025-12073 affects CE/EE versions 18.0–18.6.5, 18.7–18.7.3, and 18.8–18.8.3, where an authenticated user could perform SSRF against internal services by bypassing protections in the repository import functionality. The issue has been remediated in patch releases, notably the 18.6.6, 18...

CVE-2025-12073

Removed by vendor...

CVE-2025-12073

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery against internal services by bypassing...