CVE-2026-125438 is a missing authorization vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. The flaw allows unauthorized access due to incorrectly configured access control security levels. It affects versions from initial releases up to 4.1235. A fix is available in version 4.1236. The vulnerability has a CVSS score of 5.3, indicating medium severity, with impact limited to confidentiality loss without integrity or availability impact.
CVE-2026-125434 is a missing authorization vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. The flaw allows exploitation of incorrectly configured access control security levels in versions prior to 4.1236. This could lead to unauthorized actions impacting the integrity and availability of the system. The vulnerability has a medium severity score of 5.4 and has been fixed in version 4.1236.
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
* gnome-remote-desktop: gnome-remote-desktop: unauthenticated RDP sockets lack a handshake deadline (CVE-2026-96541)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.
Multiple security vulnerabilities affecting the skopeo command in Red Hat Enterprise Linux 10 have been addressed. These include denial of service issues due to excessive recursion, quadratic complexity in URL path resolution, unencrypted HTTP/2 connection handling, and indefinite TLS KeyUpdate messages. Additionally, a cross-site scripting vulnerability via pathological input in the Go html/template package was fixed. The update also disables sequoia in skopeo as a bug fix and enhancement.
The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.
Security Fix(es):
* tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-125439 is a Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) affecting versions prior to 3.5.1. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions or data. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 3.5.1.
The gcc-toolset-15-gcc package contains the GNU Compiler Collection version 15.
Security Fix(es):
* gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-124413 is a missing authorization vulnerability in WP User Manager versions prior to 2.10.5. It allows unauthorized users to exploit incorrectly configured access control security levels. The issue affects all versions from initial release up to 2.10.4 and has been fixed in version 2.10.5.
The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "module" utility, which interprets module files.
Security Fix(es):
* environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters (CVE-2026-85013)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
* xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
* xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 11.0.100~rc.2.26504.105
Runtime version: 11.0.0~rc.2.26504.105
Security Fix(es):
* .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)
Bug Fix(es) and Enhancement(s):
* Update .NET 11 to RC 1 [rhel-10.3.z] (JIRA:RHEL-266663)
* Update .NET 11 to RC 2 [rhel-10.3.z] (JIRA:RHEL-277207)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.15.
CVE-2026-115600 is a missing authorization vulnerability in the DEV Institute Restrict User Access – Membership Plugin with Force. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access. The issue affects versions from initial releases up to 2.8.3. A fix is available in version 2.8.4. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector and no privileges or user interaction required.
Multiple security vulnerabilities have been identified and fixed in the podman tool, which manages container pods and images. These fixes address denial of service issues caused by excessive recursion and complexity in Go libraries, a cross-site scripting vulnerability, and an arbitrary file write vulnerability during tar extraction. The update is rated as important by Red Hat and affects all versions of podman in Red Hat Enterprise Linux 10. Users are advised to apply the provided security update to mitigate these issues.
CVE-2026-122671 is a missing authorization vulnerability in the E2Pdf.com e2pdf plugin affecting versions prior to 2.00.00. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to sensitive data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily on confidentiality. A fix is available in version 2.00.00.
A security vulnerability (CVE-2026-19953) exists in the perl-URI module used in Red Hat Enterprise Linux 10. The flaw involves a security bypass caused by incorrect hostname encoding due to missing Unicode normalization. This issue affects the URI class implementation for Perl, which handles Uniform Resource Identifier references. Red Hat has issued a security update to address this vulnerability.