EUVD-2026-76153

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-89263

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

EUVD-2026-76136

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-89263 MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-89263

MoguBlog through version 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated remote attackers to disable email reply notifications for arbitrary users. The root cause is a missing authentication check in the endpoint handler, which perm...

CVE-2026-89263 MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in browserslist

Summary Platform Navigator in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in browserslist. CVE-2026-73088, CVE-2026-73089 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-73088 DESCRIPTION: Browserslist is a configuration tool for sharing...

Security Bulletin: IBM DB2 Developer extension is affected via vulnerability in spring-web(CVE-2026-22741)

Summary IBM DB2 Developer extension is affected via vulnerability in spring-webCVE-2026-22741 Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

SUSE-SU-2026:4129-1 Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

DEBIAN-CVE-2026-89092

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

AZL-100019 CVE-2026-89092 affecting package glibc 2.38-21

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

CVE-2026-89092

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

UBUNTU-CVE-2026-89092

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

CVE-2026-89092

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

CVE-2026-89092

A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System DNS server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, causing it to crash and leading to degraded DNS resolution for...

EUVD-2026-75897

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

CVE-2026-89092 Stack overflow in nscd due to unbounded alloca use

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...