CVE-2026-43778

CVE-2026-43778 is a use-after-free issue addressed with improved memory management that can allow an app to terminate the system or corrupt kernel memory. Affected products/versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26....

CVE-2026-66397 phpMyFAQ before 4.1.6 Path Traversal via category image deletion

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...

Important: Red Hat Security Advisory: OpenShift Virtualization v4.19 Images

Red Hat OpenShift Virtualization release v4.19 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...

Important: Red Hat Security Advisory: OpenShift Virtualization v4.20 Images

Red Hat OpenShift Virtualization release v4.20 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...

Important: Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

Red Hat OpenShift Virtualization release v4.17 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...

PT-2026-65262

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination...

PT-2026-65143

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description An injection issue exists where an application may be able to gain root privileges due to insufficient validation...

Privilege Escalation of Poly Devices on the Android Platform

A local attacker who can execute code on the device could potentially escalate privileges through the Android Runtime vulnerability. HP has released updates to mitigate the potential vulnerabilities. HP has identified affected products with minimum versions that mitigate the potential...

PT-2026-65266

This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user...

PT-2026-65145

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may lead to unexpected app...

Critical Photon OS Security Update - PHSA-2026-5.0-92-0931

Updates of 'harfbuzz', 'linux', 'linux-esx' packages of Photon OS have been released...

TencentOS Server 3: git-lfs (TSSA-2026:0771)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0771 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2026-64998

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description Authenticated attackers can delete arbitrary files due to insufficient sanitization of path traversal sequences in the existing image field during category updates. This issue occurs within the...

Security update for trivy (important)

openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0263-1 Rating: important References: 1266495 1268356 1269269 1269271 1271658 1271670 Cross-References: CVE-2026-39821 CVE-2026-46680 CVE-2026-50151 CVE-2026-54448 CVE-2026-55092 CVE-2026-56852 CVSS scores:...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.18.0-0.6.hum1 aarch64, x8664 nodejs24-bin-24.18.0-0.6.hum1 noarch nodejs24-devel-24.18.0-0.6.hum1 aarch64, x8664 nodejs24-docs-24.18.0-0.6.hum1 noarch...

sharepoint-2026-poc

SharePoint /trust WS-Federation Deserialization — PoC & Det...

nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

A vulnerability in the NGINX ngxhttpslicemodule allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: sqlite: lemon-3.53.4-0.1.hum1 aarch64, x8664 sqlite-3.53.4-0.1.hum1 aarch64, x8664 sqlite-analyzer-3.53.4-0.1.hum1 aarch64, x8664 sqlite-debug-3.53.4-0.1.hum1 aarch64, x8664...

CVE-2026-66013 OpenRemote before 1.26.2 Authentication Bypass via Console Registration

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

EUVD-2026-49044

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...