This update for gnome-shell fixes the following issue:
- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to
an out-of-bounds read (bsc#1280619).
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.
A 2026 study scanned 4,688 US small business websites and found that only 8 (0.17%) implemented a Content-Security-Policy (CSP) that effectively restricts scripts. Nearly half of the sites met none of seven basic security header criteria checked, including headers like HSTS, X-Content-Type-Options, and clickjacking protection. While many sites send some headers, the adoption of strong security headers is low, especially for script-restricting CSPs. The study highlights a widespread lack of basic HTTP security header adoption among small business websites, which represent a low-cost security layer. However, the absence of these headers does not necessarily prove sites are vulnerable or hackable, but indicates a missed opportunity for improving security posture.
A user new to Kali Linux reports difficulty entering commands in the terminal, specifically that keyboard input does not appear when typing a password after issuing 'sudo su'. The user also asks for confirmation on command syntax for extracting a tar.gz file and expresses general struggles with Linux command line usage and errors. This is a help request from a beginner rather than a security vulnerability or threat.
CVE-2026-100886 is a critical improper authentication vulnerability affecting Seetong T8108, T8108P, T8116, and T8232 devices running version 4.6.1.4-build202604241011. The flaw exists in an unknown function of the Debug Service component and allows remote attackers to bypass authentication. Exploit code is publicly available. Upgrading to version 4.6.2.0 resolves the issue. The vendor has not responded to disclosure attempts.
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended.
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource identifiers. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.2.6 is sufficient to resolve this issue. The identifier of the patch is 13d6988cda8d69ece45ee1890effc90a7f21cdc1. It is suggested to upgrade the affected component.
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to version 2.2.6 is sufficient to fix this issue. This patch is called a399404a388d8ad2700a01349d0d98069c8e85a4. The affected component should be upgraded.
CVE-2026-96284 is a low-severity vulnerability in Red Hat Enterprise Linux 10 where improper link resolution before file access allows a malicious user to read files in the flatpak-system-helper context. This occurs if a system OCI repository is configured and the OCI code paths follow symlinks when importing OCI images controlled by the user.
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-96281 is an improper access control vulnerability in Red Hat Enterprise Linux 10 involving Flatpak app version downgrades. A local user with an active login session can remove the app's remote reference via an unprivileged method, causing the anti-downgrade mechanism to fail. This allows the user to downgrade a system-wide Flatpak app to an older version that may contain unfixed vulnerabilities, potentially exposing other users on the same system to risk.
A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} (cmd/dashboard/controller/oauth2.go) reflects the attacker-supplied HTTP Host header into the redirect_uri sent to the identity provider instead of falling back to the configured install_host. An attacker who induces a victim to begin OAuth2 login via a request that reaches Nezha with a forged Host header can cause an attacker-controlled callback URL to be used as the redirect_uri; if the OAuth2 provider accepts it, the victim's authorization code is delivered to the attacker origin, allowing the attacker to complete the OAuth2 login/binding flow and take over the account. This regresses the fix for GHSA-9rc6-8cjv-rcvx and is configuration-dependent (dashboard_host empty). At the time of the advisory no patched version was available.
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.
CVE-2026-101088 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the nezha monitoring tool versions >=2.2.11 and <2.3.1. An authenticated user with member role can trigger a concurrent server deletion to cause a panic in the sentinel worker, crashing the entire instance. This occurs because of an incomplete fix that reuses a stale pointer without proper re-validation under locking. The issue is fixed in version 2.3.1.
Nezha versions 2.0.10 through 2.3.2 contain a server-side request forgery (SSRF) vulnerability due to incomplete denylist coverage of IPv6 transition ranges in the HTTP client used for validating user-configurable webhook URLs. Authenticated users can exploit this to cause the dashboard to send requests to certain IPv6 endpoints that are normally restricted. The vulnerability is fixed in version 2.3.3 by blocking the problematic IPv6 prefixes.