PT-2026-96553

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf validity cache sechdrs, section sizes and offsets are validated, unless the section type is SHT NULL or SHT NOBITS. Later, elf validity cache secstrings and elf validity cache...

CVE-2026-89573: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

PT-2026-90476

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management swap system where a hibernation slot is incorrectly freed while it is still present in the swap cache. This occurs because the swap free...

CVE-2026-79362

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

CVE-2026-79362: Improper Control of Generation of Code

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

PT-2026-89678

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.3.4 and later Description The nscd service in the GNU C Library may experience a stack overflow when processing an oversized response from a malicious DNS server. This occurs when the service handles DNS records large...

CVE-2026-79362

Certain Woltlab products are vulnerable to Remote Code Execution (RCE) via Cache Poisoning in the WCF component. The vulnerability affects versions WCF >= 6.1.0 until = 6.2.0 until

CVE-2026-89263: Missing Authentication for Critical Function

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107292)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107292 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayedwork on cachectr error An unexpected WARNON from...

openSUSE 16: libzypp / libzypp-devel / zypper / zypper-aptitude / zypper-log / etc (openSUSE-SU-2026:21808-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21808-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. Non security issues fixed: - Eco...

PT-2026-90290

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm array component where array block headers are not properly validated during read operations. The array block check function only validates the block number and...

PT-2026-90086

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache component where the get cache segment function scans the segment map up to the physical device segment count, while cache segs init only initializes segments...

PT-2026-90088

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache module where the tail-kset read in the cache replay function, the writeback worker, and the GC worker bounds its length by the raw segment size PCACHE SEG SI...

CVE-2026-80434

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...

CVE-2026-80434

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an insecure direct object reference (IDOR) flaw that allows a remote authenticated attacker to manipulate runtime caches and cause a denial of service . The vulnerability carries a CVSS 3.1 score of 7.4 (HIGH) , with a scope change indica...

EUVD-2026-75702

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

CVE-2026-88059 Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to cert-manager ( CVE-2026-25518 )

Summary Potential vulnerabilities in cert-manager package CVE-2026-25518 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-25518 DESCRIPTION: cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and...

taky-cache-loop (0.0.1), taky-redis-throttle (0.0.1) potentially affected by unknown CVE via every-time (0.0.0)

every-time NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on every-time and may be impacted: - taky-cache-loop 0.0.1 - taky-redis-throttle 0.0.1 Source cves: unknown CVE Source advisory: GHSA-W785-48P4-H5JJ...

CVE-2026-15889

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...