traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.
Red Hat Edge Manager version 1.2.2 includes security updates addressing two vulnerabilities: a denial of service in gRPC-Go via malformed RPC requests (CVE-2026-84445) and a cross-tenant TLS configuration bleed in the flightctl package affecting HTTPS transport (CVE-2026-92615). These issues impact the flightctl component used in managing edge devices and container workloads. The update provides fixes to mitigate these vulnerabilities.
A vulnerability in the armurox loggingredactor Python library prior to version 0.0.7 allows sensitive information to be logged without redaction when non-primitive objects with custom __str__ or __repr__ methods are logged. This causes personally identifiable information to appear in logs that are expected to mask such data. The issue is fixed in version 0.0.7.
Multiple security vulnerabilities have been identified in the Data Plane Development Kit (dpdk) packages used for fast packet processing in user space. These include memory size validation issues, heap overflows, use-after-free, out-of-bounds writes, infinite loops, and buffer overflows affecting various components such as vhost, vhost-crypto, and nfp vDPA driver. The vulnerabilities could allow a guest to cause memory corruption or denial of service on the host system. Red Hat has released security updates addressing these issues for Red Hat Enterprise Linux 9 and its variants.
CVE-2026-57154 is a high-severity injection vulnerability in the OPNsense core firewall and routing platform prior to versions 26.1.11 and 26.4.1p1. Authenticated users with delegated access to certain settings can inject carriage return or line feed characters into single-line fields, causing privileged service configuration files to include attacker-controlled directives. This affects multiple services including Dnsmasq, OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP/MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Exploitation can lead to altered service behavior, crossing of RBAC boundaries, denial of service, and in some cases root command execution. The issue is fixed in versions 26.1.11 and 26.4.1p1.
CVE-2026-119922 is an improper access control vulnerability in the AWS Babelfish for PostgreSQL extension versions 1.2 through 1.5, 2.1 through 2.15, 3.1 through 3.12, 4.0 through 4.8, and 5.1 through 5.4. This flaw allows remote authenticated users to elevate their privileges. AWS has released fixed versions 4.10, 5.6, 6.1, and later to address this issue. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.
A path traversal vulnerability (CWE-22) exists in zeroturnaround zt-zip versions prior to 1.18.0. The Zips.get(zip).unpack().destination(outputDir).process() API constructs output file paths directly from ZIP entry names without validating that files remain within the intended output directory. This allows crafted ZIP entries with parent-directory traversal sequences to write files outside the designated output directory. The issue is fixed in version 1.18.0.
CVE-2026-44267 is a critical cross-site scripting (XSS) vulnerability in the Elo expression language used by enspirit. Versions prior to 1.0.1 allow attacker-controlled strings to execute arbitrary JavaScript code via the .constructor.constructor property. This flaw affects the defaultFormats.elo.parse() function, the bin/elo CLI, and the elo-lang.org/try playground, enabling browser script execution and session compromise. It also permits arbitrary Node.js code execution in environments using the library. The issue is fixed in version 1.0.1.
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.
CVE-2026-44265 is an improper input validation vulnerability in enspirit elo versions prior to 1.0.1. The vulnerability arises because Elo's programmatic AST API accepts arbitrary values from untyped sources and interpolates them into generated code without runtime syntax validation. This affects multiple fields such as int_literal/float_literal values, variable names, member access properties, object literal keys, datapath segments, lambda parameter names, and SQL let binding names. Exploitation can lead to arbitrary code execution in JavaScript, Ruby, and Python environments, as well as SQL injection in SQL targets. The issue is fixed in version 1.0.1.
The gvmabc package on npm contains malicious code that compromises any computer on which it is installed or running. Full system compromise is likely, and all secrets and keys on the affected system should be rotated immediately from a separate, trusted device. Removing the package alone may not eliminate all malicious components due to potential persistent control by an attacker.
The y0syoh package on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a secure, separate machine. Removal of the package alone may not fully eliminate the malicious presence due to potential additional malware installed by the package.
The npm package 'wolce9' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious components or backdoors introduced by the package.