The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security update for gvisor-tap-vsock, a Go-based replacement for libslirp and VPNKit. The update addresses multiple denial of service vulnerabilities and a man-in-the-middle vulnerability in various Go libraries used by gvisor-tap-vsock. These include excessive recursion in ASN.1 unmarshalling, unencrypted HTTP/2 connection issues, indefinite TLS KeyUpdate messages, crafted HTTP Range headers, multiple ECH outer extension references, memory limit bypass in multipart form parsing, and untrusted intermediate certificates allowing man-in-the-middle attacks. The update is rated as Important by Red Hat and affects Red Hat Enterprise Linux 9 on multiple architectures.
CVE-2026-125446 is a Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge affecting versions prior to 4.3.5. This flaw allows an attacker to trick authenticated users into performing unwanted actions on the affected application. The vulnerability is rated high severity with a CVSS score of 8.8. A fix is available in version 4.3.5.
jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.
Security Fix(es):
* jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979)
* jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
X.Org X11 libXrender runtime library
Security Fix(es):
* libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-125782 is a missing authorization vulnerability in Blubrry Podcasting PowerPress Podcasting affecting versions prior to 11.18.3. This flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity score of 4.3 and does not affect confidentiality or availability. A fix is available in version 11.18.3.
Fortinet released 89 security advisories addressing nearly 100 vulnerabilities across multiple products, including FortiMail, FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE, and FortiClient. Among these, approximately 17 are critical-severity flaws that could enable arbitrary code execution, authentication bypass, account takeover, and other serious impacts. No exploitation in the wild has been reported. The vulnerabilities were discovered using AI-enhanced security testing integrated by Fortinet.
CVE-2026-125435 is a vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) that allows insertion of sensitive information into sent data. This flaw affects versions from the initial release up to 3.1.3. The vulnerability could lead to unauthorized retrieval of embedded sensitive data. A fix is available in version 3.1.4.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Guava is a suite of core and expanded libraries that include utility classes, Google’s collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies.
Security Fix(es):
* com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-124417 is a missing authorization vulnerability in the Ahmad WP Job Portal plugin for WordPress. It affects versions from initial release up to 2.7.2. The flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue is fixed in version 2.8.0.
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.
Security Fix(es):
* libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274)
* libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276)
* libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275)
* libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-124269 is a missing authorization vulnerability in the Happy Addons for Elementor plugin by weDevs. The flaw allows exploitation due to incorrectly configured access control, affecting versions from initial releases up to 3.51.0. A fix is available in version 3.51.3. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-124262 is a medium severity vulnerability in the Igor Funa Ad Inserter plugin that allows improper neutralization of script-related HTML tags, leading to basic cross-site scripting (XSS). This affects versions prior to 2.8.20. The vulnerability can enable code injection via crafted input. A fix is available in version 2.8.20.
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
* gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
* gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
* gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
* gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.
Security Fix(es):
* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Core part of Jackson that defines Streaming API as well as basic shared abstractions.
Security Fix(es):
* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.
Security Fix(es):
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.