EUVD-2026-42971

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN...

ROOT-OS-DEBIAN-13-CVE-2026-3783 CVE-2026-3783 in rootio-curl - Patched by Root

Root has patched CVE-2026-3783 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-6253 CVE-2026-6253 in rootio-curl - Patched by Root

Root has patched CVE-2026-6253 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-14524 CVE-2025-14524 in rootio-curl - Patched by Root

Root has patched CVE-2025-14524 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-3805 CVE-2026-3805 in rootio-curl - Patched by Root

Root has patched CVE-2026-3805 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-3784 CVE-2026-3784 in rootio-curl - Patched by Root

Root has patched CVE-2026-3784 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-6276 CVE-2026-6276 in rootio-curl - Patched by Root

Root has patched CVE-2026-6276 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-14819 CVE-2025-14819 in rootio-curl - Patched by Root

Root has patched CVE-2025-14819 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-5773 CVE-2026-5773 in rootio-curl - Patched by Root

Root has patched CVE-2026-5773 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-5545 CVE-2026-5545 in rootio-curl - Patched by Root

Root has patched CVE-2026-5545 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-8328 CVE-2026-8328 in rootio-python3.13 - Patched by Root

Root has patched CVE-2026-8328 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-14894

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submitform function. This is due to missing file type validation and the absence of any capability check on the submitform nopriv AJAX...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.13: python3.13-3.13.14-1.3.hum1 aarch64, x8664 python3.13-debug-3.13.14-1.3.hum1 aarch64, x8664 python3.13-devel-3.13.14-1.3.hum1 aarch64, x8664 python3.13-freethreading-3.13.14-1.3.hum1...

EUVD-2026-38358

pypdf: Possible infinite loop when processing threads/articles in writer...

GHSA-G9XF-7F8Q-9MCJ pypdf: Possible infinite loop when processing threads/articles in writer

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. Patches This has been fixed in pypdf==6.13.1. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3839...

ROOT-OS-DEBIAN-13-CVE-2026-12912 CVE-2026-12912 in rootio-tiff - Patched by Root

Root has patched CVE-2026-12912 in the rootio-tiff package for Root:Debian:13. Multiple fixed versions available...

CLEANSTART-2026-DW47642 Security fixes for CVE-2025-61732, CVE-2025-68121 applied in versions: 2.13.1-r0

Multiple security vulnerabilities affect the rancher-agent package. These issues are resolved in later releases. See references for individual vulnerability details...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper enforcement of the Certificate Revocation List on the gRPC listener when separate listeners are configured for HTTP and gRPC client endpoints. An attacker can gain unauthorized access and...

CVE-2026-14487

The CVE-2026-14487 entry concerns the WordPress plugin Simple Coherent Form (SCF). Affected versions are all up to and including 2.4.13. The root cause is insufficient file path validation in the removeUploadDir function, enabling unauthenticated deletion of arbitrary server files (e.g., wp-confi...

PYSEC-2026-2036 Weblate has a long session expiry when verifying second factor

Impact The verification of the second factor had too long a session expiry. The long session expiry could be used to circumvent rate limiting of the second factor. Patches This issue has been addressed in Weblate 5.13.1 via https://github.com/WeblateOrg/weblate/pull/16002. References Thanks to...