AZL-107246 CVE-2026-78663 affecting package containerd2 2.3.4-1

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-106919 CVE-2026-102554 affecting package guava 33.0.0-1

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

GHSA-846F-F764-76MX Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignedCms.CheckSignature can...

GHSA-C27M-942F-RCFH Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS synthetic...

AZL-107330 CVE-2026-78663 affecting package docker-cli 25.0.7-5

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-107815 MariaDB: one byte OOB write in DOS tables of the CONNECT engine

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

MGASA-2026-0506 Updated kernel, drakx-installer-images, kmod-nvidia-current-wopengpu, kmod-xtables-addons & kmod-virtualbox packages fix Security Vulnerabilities

Upstream kernel 6.18.55 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel...

GHSA-7HQP-7C5M-4VQ6 Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XM...

CLSA-2026-1791806348 TuxCare security update for msgpack5 (7 CVEs)

TuxCare rebuilt msgpack5 to address 7 CVEs. Fixed in 4.5.1-tuxcare.1...

RLSA-2026:79281 Moderate: glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cache daemon nscd used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fixes: glibc:...

MAL-2026-17754 Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

AZL-107132 CVE-2026-89091 affecting package ansible 2.17.11-1

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

DEBIAN-CVE-2026-98385

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple schedcachegroup from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics schedcachestat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In...

CLEANSTART-2026-HO68117 vm2 before 3

Security vulnerability affects the n8n package. vm2 before 3...

CVE-2026-108266 Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2026-107805 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...

EEF-CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi...

EEF-CVE-2026-81856 Terminal escape sequence injection in Hex via unneutralized server-supplied output

Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the...

RHSA-2026:80172 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:79778 Red Hat Security Advisory: kernel security update

Bulletin has no description...

RHBA-2025:4932 Red Hat Bug Fix Advisory: dotnet8.0 bug fix and enhancement update

Bulletin has no description...

CVE-2026-62367 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider emailfallback option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local username+password account using only the email cla...

CVE-2026-57458 Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

CVE-2026-107890

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPPTAGZERO, but addjob converts these separators to IPPTAGJOB. During job startup, getoptions/ipplength subsequentl...

OPENSUSE-SU-2026:12090-1 bouncycastle-1.86-1.1 on GA media

These are all security issues fixed in the bouncycastle-1.86-1.1 package on the GA media of openSUSE Tumbleweed...

AZL-107297 CVE-2026-107161 affecting package cyrus-sasl 2.1.28-8

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...

CVE-2026-103007 Incorrect Authorization in Elasticsearch Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets a...

CVE-2026-110598 Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

RUSTSEC-2026-0346 `Debug` impls for client session values expose TLS secrets

The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output. Custom ClientSessionStore implementations that format these values with Debug for example, when logging could disclos...

RHSA-2026:81410 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

MGASA-2026-0500 Updated perl-Imager package fixes security vulnerabilities

Buffer read underflows on 32-bit sizet systems decoding EXIF data. CVE-2026-73638 Palette off-by-one discloses uninitialized heap memory. CVE-2026-93018 TGA reader: signed colourmaplength causes process-killing allocator abort. CVE-2026-93019 Unvalidated rawdatachannels can cause incorrect memory...

MGASA-2026-0484 Updated libextractor package fixes security vulnerabilities

GNU libextractor before 1.15 Stack Overflow via OLE2. CVE-2026-91752 GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTORPREFIX. CVE-2026-100310...

MAL-2026-17826 Malicious code in @revizahoshii/hoshino-media-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65fe484d1302a25cb129e7fb56ebbf059f4c9469a85abc10ac695e605e34dcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2026-1791806459 TuxCare security update for nodemailer (11 CVEs)

TuxCare rebuilt nodemailer to address 11 CVEs. Fixed in 9.0.6-tuxcare.1...

CLSA-2026-1791742369 TuxCare security update for league/flysystem (1 CVE)

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.0.70-p2+tuxcare...

DEBIAN-CVE-2026-108577

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...

CVE-2026-108705 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

MINI-C4P3-84G8-V6F6

Bulletin has no description...

CVE-2026-108164 Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...

RHSA-2026:79784 Red Hat Security Advisory: kernel security update

Bulletin has no description...

RHSA-2026:79011 Red Hat Security Advisory: rhc security update

Bulletin has no description...

CLSA-2026-1791627107 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.4...

CLSA-2026-1791626237 TuxCare security update for vm2 (1 CVE)

TuxCare rebuilt vm2 to address 1 CVE. Fixed in 3.11.7-tuxcare.2...

CVE-2026-97348 SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...

CVE-2026-103482 Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot

The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptinfields e.g. firstname' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

CVE-2026-107851 Contao: Improper access control in the table access voter

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...

CVE-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...