CLEANSTART-2026-QN49433 HashiCorp memberlist before version 0

Multiple security vulnerabilities affect the weaviate-fips package. HashiCorp memberlist before version 0. See references for individual vulnerability details...

PT-2026-87112

An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message...

Build Numbers and Versions of Veeam Plug-In for KubeVirt

This KB article lists all versions of the Veeam Plug-In for KubeVirt and their respective worker build numbers. Version | Plug-In / Worker Build | Release Date ---|---|--- Veeam Plug-In for KubeVirt 1 Releases Veeam Plug-In for KubeVirt 1.0 Independent Plug-In Release | 13.1.0.428 | 2026-09-08...

CVE-2026-79570

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78742

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

CVE-2026-78738

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

CVE-2026-78738

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

Security update for lxd (critical)

openSUSE security update: security update for lxd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21788-1 Rating: critical References: bsc1223794 bsc1274936 bsc1274937 bsc1274954 bsc1274961 bsc1274963 bsc1275084 bsc1275085 bsc1275090 Cross-Reference...

PT-2026-86997

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...

PT-2026-86998

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

PT-2026-87014

OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, fr...

PT-2026-87109

Name of the Vulnerable Software and Affected Versions PayTR Virtual Pos iFrame API WHMCS Module versions 9.0.0 through 9.0.2 Description An observable timing discrepancy exists in the PayTR Virtual Pos iFrame API WHMCS Module. This flaw allows for Black Box Reverse Engineering, a technique used t...

F5 Networks BIG-IP : BIND vulnerability (K000163233)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163233 advisory. If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may...

PT-2026-88319

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function is within roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...

PT-2026-88503

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

valkey security, bug fix, and enhancement update

8.0.10-1 - Rebase to 8.0.10 for CVE-2026-56684 CVE-2026-63639 CVE-2026-66373 in redis...

PT-2026-86993

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-78742

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in JsonLoader.fromURL, which fetches any URL without validation, and to memory amplification through JacksonUtils.newMapper, which enables WRITEBIGDECIMALASPLAIN so a BigDecimal serializes via...