Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-105295

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

EUVD-2026-92159

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295

GitAhead versions 2.5.0 through 2.7.1 are vulnerable to an insecure update mechanism that fails to perform integrity or signature verification on downloaded updates. Additionally, the application permanently ignores TLS errors after a single SSL error dialog is presented. A network attacker can e...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

PT-2026-104711

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer 0/admins/assessments/activities/btn functions.php?action=update. The manipulation of the argument Title results in sql injection. The attack may be...

PT-2026-106043

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

CVE-2026-105295: Download of Code Without Integrity Check

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

PT-2026-104669

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

PT-2026-106224

Name of the Vulnerable Software and Affected Versions Feehi CMS version 2.1.1 Description Incorrect Access Control allows a low-privilege backend administrator with administrator-update permission to change the password of the built-in super administrator account. This occurs because the server...

OpenSSL Buffer Overflow

The vulnerability of the buffers in CipherCtxRef::cipherupdate, CipherCtxRef::cipherupdatevec, and symm::Crypter::update functions in the OpenSSL library for the Rust programming language is related to buffer overflows in the dynamic memory. Exploiting this vulnerability could allow an attacker t...

PT-2026-106021

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspace slug/projects/project id/members/member pk/ to change another user's project role. The role-update logic block...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

PT-2026-106000

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update questio...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control (CWE-284). A low-privilege backend administrator possessing administrator-update permissions can modify the password of the built-in super administrator account. This is possible because the server fails to enforce protections for the supe...

PT-2026-106032

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

PT-2026-106023

A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update subaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument user id causes improper...