ROOT-OS-ALPINE-321-CVE-2026-9547 CVE-2026-9547 in curl - Patched by Root

Root has patched CVE-2026-9547 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

Astra Linux – Vulnerability in Qemu

The ethgetgsotype function in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process by sending packet data that lacks a valid Layer 3 protocol...

Security Bulletin: Security Vulnerability in Axios affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-40175)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Axios Vulnerability Details CVEID:CVE-2026-40175 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific...

EUVD-2026-42933

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket...

EUVD-2026-55618

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

EUVD-2026-54257

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1...

CVE-2026-66705

Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...

CVE-2026-66705 WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.21.1...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-5241

Summary IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-5241, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-5241 DESCRIPTION: A vulnerability in the LightGlue...

CLSA-2026-1785380226 TuxCare security update for org.springframework.amqp (2 CVEs)

TuxCare rebuilt 4 org.springframework.amqp packages to address 2 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1...

CLSA-2026-1785204378 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 6.2.1-tuxcare.1...

CLSA-2026-1783040444 TuxCare security update for @angular (15 CVEs)

TuxCare rebuilt 17 @angular packages to address 15 CVEs. Fixed in 15.2.1-tuxcare.2...

CLSA-2026-1782954041 TuxCare security update for @angular (14 CVEs)

TuxCare rebuilt 19 @angular packages to address 14 CVEs. Fixed in 7.2.1-tuxcare.3...

CLSA-2026-1782089812 TuxCare security update for js-cookie (1 CVE)

TuxCare rebuilt js-cookie to address 1 CVE. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1774225199 TuxCare security update for yargs-parser (1 CVE)

TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 4.2.1-tuxcare.1...

PYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summary pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An...

JLSEC-2026-1118

A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikonloadpaddedpackedraw of the file src/decoders/decoderslibraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument loadflags/rawwidth can lead to out-of-bounds read. It is possible to launch the...

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

CVE-2026-16614 GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...