Security Bulletin: Security Vulnerability in Axios affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-40175)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Axios Vulnerability Details CVEID:CVE-2026-40175 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific...

Astra Linux – Vulnerability in Qemu

The ethgetgsotype function in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process by sending packet data that lacks a valid Layer 3 protocol...

EUVD-2026-42933

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket...

ROOT-OS-ALPINE-321-CVE-2026-9547 CVE-2026-9547 in curl - Patched by Root

Root has patched CVE-2026-9547 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

EUVD-2026-55618

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

CLSA-2026-1785204378 TuxCare security update for ws (8 CVEs)

TuxCare rebuilt ws to address 8 CVEs. Fixed in 6.2.1-tuxcare.1...

CLSA-2026-1782089812 TuxCare security update for js-cookie (12 CVEs)

TuxCare rebuilt js-cookie to address 12 CVEs. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1774225199 TuxCare security update for yargs-parser (3 CVEs)

TuxCare rebuilt yargs-parser to address 3 CVEs. Fixed in 4.2.1-tuxcare.1...

PYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summary pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An...

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

CLEANSTART-2026-KV57465 Security fixes in airflow-3 3.2.1-r2

Package airflow-3 version 3.2.1-r2 fixes 5 vulnerabilities: CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526...

CVE-2026-54719 goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...

CVE-2026-54719

The CVE-2026-54719 vulnerability affects goshs, a single-binary file server. Before version 2.1.1, the httpserver/updown.go bulkDownload handler invoked via the ?bulk and file= ZIP downloads could bypass ACL checks (findEffectiveACL / applyCustomAuth), permitting unauthenticated reads of files pr...

CVE-2026-62325 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

CVE-2026-13110

The CVE concerns the Storegrowth Sales Booster plugin for WordPress (up to version 2.1.0) with a Missing Authorization flaw in the bogo_category_msg_create AJAX handler. The vulnerability arises from a missing capability check, as the handler is registered for both authenticated (wp_ajax_) and un...

Linux Distros Unpatched Vulnerability : CVE-2026-54272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through...

CVE-2026-12421

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

CVE-2026-9713

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

Oracle Linux 10 : .NET / 8.0 (ELSA-2026-21286)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21286 advisory. 8.0.128-1.0.1 - Add support for Oracle Linux 8.0.128-1 - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 8.0.127-1 - Update to...