Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support formerly Bomgar versions 26.2.3 and earlier. Patches are available for supported versions 24.3.1 and later; organizations using older versions must upgrade first. Cyber threat actor...

WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability

SQL Injection vulnerability discovered by DERISK in WordPress Plugin Support Genix versions = 1.4.54...

Kwetsbaarheid verholpen in BeyondTrust Remote Support

BeyondTrust has discovered a critical vulnerability in BeyondTrust Remote Support. This vulnerability, identified as CVE-2026-102764, has a CVSS score of 9.3. It involves insufficient validation of the origin of messages within the product’s internal components. As a result, a malicious actor...

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-nexus cyber espionage group tracked as Armory Castle previously UNC5221 or Warp Panda exploited a newly disclosed security flaw in BeyondTrust Remote Support formerly Bomgar as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 CVSS score: 9.3, is a case of...

CVE-2026-104000

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance...

CVE-2026-102764

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...

CVE-2026-102764

BeyondTrust Remote Support versions prior to 26.2.3 are vulnerable to an unauthenticated file upload flaw caused by insufficient validation of message origins within internal components. This allows a remote attacker to perform arbitrary file operations, potentially leading to full host compromis...

CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...

GHSA-7CXH-94CF-MFP6 Talos Linux: Support bundle does not redact registry credentials

Summary When generating a support bundle with talosctl support the credentials entered for private registries are included in the bundle. Details Within the generated support bundle, inside resources/registryconfigs.cri.talos.dev.yaml the auth field of the spec is retained. The same, potentially...

Talos Linux: Support bundle does not redact registry credentials

Summary When generating a support bundle with talosctl support the credentials entered for private registries are included in the bundle. Details Within the generated support bundle, inside resources/registryconfigs.cri.talos.dev.yaml the auth field of the spec is retained. The same, potentially...

EUVD-2026-101424

Talos Linux: Support bundle does not redact registry credentials...

GHSA-QFXX-C367-67F8 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Summary CVE-2026-30973 GHSA-rfx7-4xw3-gh4m was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by...

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Summary CVE-2026-30973 GHSA-rfx7-4xw3-gh4m was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by...

EUVD-2026-101529

Appium: Symlink based Zip Slip in @appium/support ZIP extraction...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: geneve: Fixed header validation in geneve6xmitskb. syzbot is able to trigger an uninit-value in genevexmit. Problem: While most IP tunnel helpers such as iptunnelgetdsfield use skbprotocolskb, true, pskbinetmaypull only uses...

Astra Linux – Vulnerability in gnupg2

In GnuPG before version 2.4.9, the armorfilter function in g10/armor.c had two increments of an index variable, where only one was intended. This led to a out-of-bounds write vulnerability with crafted inputs. This issue has been fixed in ExtendedLTS versions, 2.2.51 and later...