Payload: Incomplete validation during the upload file lifecycle

Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...

GHSA-P223-2WR2-J562 Payload: Incomplete validation during the upload file lifecycle

Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...

GHSA-Q38J-6VCM-2F5M Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern...

EUVD-2026-93986

Backstage: Improper validation of MkDocs plugin configuration in TechDocs...

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

Summary A crafted ZIP-compressed OpenEXR image can return stale memory from a prior ImageSharp operation as decoded pixels. The ZIP decoder accepts a non-empty inflate result shorter than the EXR block's required size, then the EXR decoder reads the full expected block. This is a process-local,...

GHSA-4Q3P-RJ5X-XV7P ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

Summary A crafted ZIP-compressed OpenEXR image can return stale memory from a prior ImageSharp operation as decoded pixels. The ZIP decoder accepts a non-empty inflate result shorter than the EXR block's required size, then the EXR decoder reads the full expected block. This is a process-local,...

CVE-2026-97717

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

EUVD-2026-94614

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before version 23.0.1 , a vulnerability exists in the WebSocket transport where it fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token . An authenticated user with a valid token for one project can substitute another pr...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-97717

CVE-2026-97717 is a vulnerability in the proxy sub-system of Absolute Secure Access servers running versions prior to 14.60 . An authenticated attacker can exploit this flaw by sending malformed data to the server, resulting in a persistent denial of service . No specific exploit information or r...

EUVD-2026-94576

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

CVE-2026-97717 Denial of Service in Absolute Secure Access

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

CVE-2026-97717 Denial of Service in Absolute Secure Access

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

EUVD-2026-94580

CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service...

CVE-2026-97715 Denial of Service in Absolute Secure Access

CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service...

Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI products - 1 EDB PGAI AI Factory with IBM 1.3.0, 2 EDB PGAI Analytics Accelerator 1.3.0, and 3 EDB PGAI Hybrid Data Management 1.3.0. The vulnerabilities have been addressed in 1.4.1 version. Hence, IBM strongly recommends upgrading to 1.4.1...

CVE-2026-107313

The PostgreSQL JDBC Driver (pgjdbc) versions 42.7.4 and 42.7.5 contain a vulnerability where the driver can send previous contents of the GSS send buffer instead of the intended large value on connections using GSS encryption (specifically when gssEncMode is set to prefer or require). This occurs...