CVE-2026-14646 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect

Nexus Repository 3 did not apply its existing Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymo...

CVE-2026-14646

Nexus Repository 3 failed to apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an ano...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to missing authentication checks for the /codex endpoint, where requests bypass the API key validation before being rewritten to protected API routes, allowing unauthenticated attackers to invoke upstream LLM provider APIs...

vim security update

8.2.2637-26.0.1.el98.10 - Remove upstream references Orabug: 31197557 2:8.2.2637-26.10 - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave 2:8.2.2637-26.9 - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3complete 2:8.2.2637-26.8 - RHEL-185874 CVE-2026-47167...

PT-2026-58108

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 affected versions not specified Description Nexus Repository 3 fails to apply Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. SSRF is a flaw that allows an...

kernel update

5.14.0-687.23.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

MAL-2026-10489 Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

CVE-2026-39245

A flaw was found in the decompress component. An improper path containment check allows a local attacker to perform directory traversal. This vulnerability, when combined with unvalidated symlink creation, enables an attacker to write arbitrary files to directories outside the intended extraction...

PYSEC-2026-2734 Open WebUI's responses passthrough endpoint lacks access control authorization

Summary The /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM providers without enforcing per-model access control. While the primary chat completion endpoint generatechatcompletion checks model ownership, group membership, and...

vim security update

8.0.1763-27.0.1 - Remove upstream references Orabug: 31197557 - Added glibc-gconv-extra to common requires to provide ISO-8859-2 Orabug: 34114984 2:8.0.1763-27 - RHEL-186656 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186648 CVE-2026-52858 vim: possible code execution wi...

kernel security, bug fix, and enhancement update

4.18.0-553.141.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

PT-2026-59662

Summary parse options header parsed Content-Disposition and Content-Type headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax filename=charset'lang'value, name=..., and the filename0/filename1 continuation form is decoded and surfac...

Fedora 43 : perl-Crypt-DSA (2026-b77b9c5f04)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b77b9c5f04 advisory. This update, to the current upstream release, addresses a cryptographic flaw modulo bias in key generation that could lead to private key compromise...

[SECURITY] [DLA 4676-1] wireless-regdb new upstream version

Debian LTS Advisory DLA-4676-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings July 11, 2026 https://wiki.debian.org/LTS Package : wireless-regdb Version : 2026.05.30-1deb11u1 2026.05.30-1deb12u1 This update includes the changes in wireless-regdb 2026.05.30,...

DEBIAN-CVE-2026-57213

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmqfederationmanagement plugin renders the consumertag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute...

CVE-2026-55233

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the...

CVE-2026-57213 RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmqfederationmanagement plugin renders the consumertag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute...

CVE-2026-55233 OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the...

CVE-2026-55233

OpenResty vulnerable versions: 1.29.2.1–1.29.2.4. A PROXY protocol v2 header construction in the stream patch can cause an out-of-bounds write, crashing the worker and causing a denial of service. This affects only configurations that enable PROXY protocol v2 for upstream connections. The issue i...

EUVD-2026-43013

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the...