Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: Version 1.3.6: When masking directories with maskPaths, runc will now re- use a...

SUSE-SU-2026:3433-1 Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: When masking directories with maskPaths, runc will now re- use ...

SUSE-SU-2026:3428-1 Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: When masking directories with maskPaths, runc will now re- use ...

Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: Version 1.3.6: When masking directories with maskPaths, runc will now re- use a...

SUSE SLES16 Security Update : runc (SUSE-SU-2026:22942-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22942-1 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

openSUSE 16 Security Update : runc (openSUSE-SU-2026:21431-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21431-1 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Othe...

Important: Red Hat Security Advisory: RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release

The 1.3.6 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

CVE-2026-57799 WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through = 1.3.6...

WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Nuss versions = 1.3.6...

CVE-2025-64152 Apache IoTDB: Path Traversal Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue...

PT-2026-49168

Name of the Vulnerable Software and Affected Versions runc versions prior to 1.3.6 runc versions prior to 1.4.3 runc versions prior to 1.5.0-rc.3 Description A flaw involving a /dev symlink allows a malicious container image to obtain limited write access to the host filesystem. This issue occurs...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via HTTP redirect handling in the HTTP client. An attacker can obtain sensitive credentials by causing a client configured to automatically follow redirects to follow a redirect from a...

CVE-2026-45284

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0...

CVE-2026-4808

The Gerador de Certificados – DevApps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the moveUploadedFile function in all versions up to, and including, 1.3.6. This makes it possible for authenticated attackers, with Administrator-level access...

CVE-2026-45284 Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0...

Malicious code in crypto-javascri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3f73f5a262aba7ba05c713d409646e419e998232fd536fd99c51750fa070699 The package crypto-javascri was found to contain malicious code. Source: google-open-source-security...

CVE-2026-1559

The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkinplaceid' parameter in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2026-1559 Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter

The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkinplaceid' parameter in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2026-1559

The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkinplaceid' parameter in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access...