RockyLinux 8 : bind9.16 (RLSA-2026:54509)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54509 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

AlmaLinux 8 : bind9.16 (ALSA-2026:54509)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54509 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-133...

RHEL 8 : Red Hat OpenStack Platform 16.2 security advisory (Important) (RHSA-2026:54757)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54757 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

CVE-2026-19025

A flaw was found in HDF5. An attacker can craft a malicious HDF5 file that, when opened and read by an application, exploits a validation bypass. This bypass, related to mismatched chunk-layout dimensionality and dataspace rank, leads to a divide-by-zero error, causing a denial of service DoS and...

CVE-2026-18428 SQL Query Validation Bypass in OpenSearch Direct Query

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...

EUVD-2026-58178

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...

CVE-2026-57894

The Gitea repository management tool is vulnerable to Server-Side Request Forgery (SSRF) via the Clone() function in modules/git/repo.go. The issue arises because the software follows Git HTTP redirects even after initial URL allow/block validation, which can lead to internal git repository exfil...

CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...

CVE-2026-66804

A flaw was found in the console component. An authenticated user can exploit a Server-Side Request Forgery SSRF vulnerability by manipulating the towerHost parameter when accessing the /ansibletower handler. This allows the user to bypass pathname validation and access arbitrary internal or...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

dompurify: DOMPurify: URI validation bypass leads to cross-site scripting

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...

CVE-2026-18193: Improper Privilege Management

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses...

CVE-2026-18428: Protection Mechanism Failure

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...

CVE-2026-73602: Improper Neutralization of Directives in Dynamically Evaluated Code

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...

ALSA-2026:54509 Important: bind9.16 security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

openSUSE 16 Security Update : go-sendxmpp (openSUSE-SU-2026:21562-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21562-1 advisory. Changes in go-sendxmpp: - Update to 0.17.0: Add --ox-transfer-private-key to transfer the encrypted private key to PEP to transfer it to other devices...

Important: bind9.16 security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

CVE-2026-67287 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...