Search: 16.5-2

The Rank Math PRO WordPress plugin version 3.0.123 was compromised in a supply chain attack, with malware injected into packages distributed between October 15 and October 16, 2026. The malicious code could allow attackers to take over websites where the plugin was activated. The malware is persistent, recreating hidden backdoors and modifying files and settings to maintain access. Rank Math released a clean version 3.0.124 immediately after discovering the compromise. Users who installed or activated version 3.0.123 during the affected window should consider their sites compromised and restore from clean backups or follow detailed cleanup steps.

CVE-2026-109433 is an authorization bypass vulnerability in Camunda 7's Cockpit webapp affecting versions 7.23.0 before 7.23.17 and 7.24.0 before 7.24.16. The flaw arises from inverted comparison logic in permission checks, allowing authenticated users with minimal access to read all process instances, definitions, and incidents engine-wide without logging. This vulnerability has a medium severity score and is fixed in versions 7.23.17 and 7.24.16.

Red Hat issued a security advisory for Submariner v0.23, a Kubernetes operator enabling cross-cluster connectivity for services and pods. The advisory addresses multiple security fixes and container updates in the Submariner operator and related components. The update is rated as having an Important security impact. The advisory references several CVEs affecting the product and provides updated container images and documentation improvements. No CVSS score is provided for these vulnerabilities. The affected product is Red Hat Advanced Cluster Management for Kubernetes version 2.16. The advisory includes links to upstream Submariner release notes and Red Hat documentation for further details.

This SUSE Linux Enterprise Kernel update addresses multiple security vulnerabilities affecting various kernel components including netfilter, KVM, 9p, SCSI target, and libceph. The update fixes issues such as improper handling of Ethernet MAC headers, page overflow in SEV encryption paths, error handling in 9p client walks, buffer appending in iSCSI encoding, scratch area length calculation in KVM SEV, duplicate leaves in network shaper requests, and multiplication overflow in Ceph decoding. These fixes collectively improve kernel security and stability.

A vulnerability in VideoLAN libbluray through version 1.5.1 involves uncontrolled memory allocation. This flaw can lead to a denial of service condition due to resource exhaustion. The issue has a medium severity rating with a CVSS score of 5.5. No public exploit code or known exploitation in the wild has been reported. Multiple versions of libbluray, including various Ubuntu package versions, are affected.

libbluray versions up to 1.5.1 contain an out-of-bounds read vulnerability that can cause a denial of service. The vulnerability has a medium severity with a CVSS score of 5.5. It requires local access and user interaction to exploit and does not impact confidentiality or integrity but affects availability.

rdesktop versions up to and including 1.9.0 contain a heap out-of-bounds read vulnerability. This flaw can cause a denial of service by crashing the application but does not impact confidentiality or integrity. The vulnerability has a CVSS score of 6.5, indicating medium severity.

rdesktop versions up to and including 1.9.0 contain a heap out-of-bounds read vulnerability. This flaw can cause a denial of service by crashing the affected application. The vulnerability has a CVSS v3.1 score of 6.5, indicating a medium severity level. No public exploit code or active exploitation in the wild has been reported. The affected versions include multiple builds of 1.8.3, 1.8.6, and 1.9.0.

rdesktop versions up to 1.9.0 contain a heap out-of-bounds read vulnerability. This flaw can cause a denial of service by crashing the affected application. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No public exploits or known active exploitation have been reported. The affected versions include multiple builds of 1.8.3, 1.8.6, and 1.9.0.

Mopidy versions before 4.0.5 contain a path traversal vulnerability that allows an attacker to access files outside the intended directories. This vulnerability has a medium severity rating with a CVSS score of 5.3. It affects multiple specific Mopidy package versions, including several releases from 1.1.0-2 up to 4.0.4-2. No public exploits or known active exploitation have been reported. Mopidy is not a cloud service, and no patch links or vendor advisories are provided in the data.

Netpbm versions up to 11.16.00 have a heap out-of-bounds read vulnerability in the rasttopnm tool. This flaw occurs when processing Sun rasterfiles with short colormaps, allowing crafted files to read adjacent heap memory or cause a crash. The vulnerability can leak up to 255 bytes of heap memory into the output.

CVE-2026-112275 is a heap out-of-bounds write vulnerability in Netpbm versions up to 11.16.00. It occurs in the rasttopnm Sun rasterfile run-length decoder function pr_load_image. An attacker can craft a specially formed rasterfile with small dimensions and a long run-length body to cause memory corruption and potential crashes by writing beyond allocated memory.

Multiple security vulnerabilities were identified in various PHP versions affecting components such as the mysqlnd driver, SOAP HTTP client, Phar extension, FastCGI client access check, and TLS handling. These issues could allow malicious servers or remote attackers to cause PHP crashes (denial of service), execute arbitrary code, inject files, bypass access restrictions, obtain sensitive information, or impersonate trusted servers. Fixes have been released for affected PHP versions across multiple Ubuntu LTS releases and other supported versions.

A vulnerability exists in the GStreamer ASF demuxer component of gst-plugins-ugly1.0, identified as CVE-2026-112214. The flaw affects multiple specific versions of gst-plugins-ugly1.0 and has a CVSS v3.1 base score of 6.5, indicating a medium severity level. The vulnerability does not impact confidentiality or integrity but can cause a denial of service (availability impact). No public exploits or known active exploitation have been reported. The affected versions are explicitly listed and include various Ubuntu package versions from 1.6.0-1ubuntu1 through 1.14.0-1. No patch or remediation information is provided in the source data.