CVE-2026-58235 Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services)

SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected...

CVE-2026-58235: Dependency on Vulnerable Third-Party Component

SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected...

PT-2026-70369

Name of the Vulnerable Software and Affected Versions AMD Vitis Libraries affected versions not specified Description A timing discrepancy exists in the ECDSA secp256k1 component. This issue allows attackers with local access to conduct timing analysis or electromagnetic emanation attacks, which...

Vitis™ Vulnerabilities

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-43606| Observable Timing Discrepancy in the Vitis™ Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagneti...

PT-2026-70027

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Adobe Document Service affected versions not specified Description The Adobe Document Service component uses outdated open source cryptographic and data transfer libraries. A low-privileged authenticated...

CVE-2026-43606: Observable Timing Discrepancy

Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptograph...

[SECURITY] Fedora 43 Update: python3.12-3.12.13-6.fc43

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +11 more potentially affected by CVE-2026-72744 via nuxt (>=4.4.7, <=4.5.0)

nuxt NPM version =4.4.7, =3.2.0, =1.13.12, =1.6.0-rc.3, =1.0.0-alpha.17, =1.0.0, =0.6.0-rc.4, =0.2.3, =1.0.0-alpha.12, =1.0.0-alpha.20 Source cves: CVE-2026-72744 Source advisory: OSV:GHSA-7C4V-FWGW-9RF7...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses micrometer-core-1.15.11.jar, spring-core-6.2.18.jar, spring-security-web-6.5.10.jar, spring-data-commons-3.5.11.jar, spring-webmvc-6.2.18.jar, spring-expression-6.2.18.jar and spring-security-config-6.5.10.jar which are vulnerable to CVE-2026-40983, CVE-2026-40984,...

CVE-2026-15656 IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2026-15656 IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2026-18531 IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret...

CLSA-2026-1778028250 TuxCare security update for org.hibernate (1 CVE)

TuxCare rebuilt 8 org.hibernate packages to address 1 CVE. Fixed in 5.4.3.Final-tuxcare.3...

CVE-2026-69244 vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries-aiohttp, py3-vllm-cuda-12.4, awx, apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk, puppygraph-python, vllm-cuda-13.2, lmcache-cuda-12.8, kserve, dask-kubernetes-fips, dask-kubernetes, apache-beam-python-3.11-sdk,...

CVE-2026-69243 vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries-aiohttp, py3-vllm-cuda-12.4, awx, apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk, puppygraph-python, lmcache-cuda-12.8, kserve, dask-kubernetes-fips, dask-kubernetes, apache-beam-python-3.11-sdk, kserve-models-web-app,...

GHSA-MFX4-HV73-Q22V vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries-aiohttp, py3-vllm-cuda-12.4, awx, apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk, puppygraph-python, lmcache-cuda-12.8, kserve, dask-kubernetes-fips, dask-kubernetes, apache-beam-python-3.11-sdk, kserve-models-web-app,...

GHSA-CQ5V-8Q36-5273 vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries-aiohttp, py3-vllm-cuda-12.4, awx, apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk, puppygraph-python, vllm-cuda-13.2, lmcache-cuda-12.8, kserve, dask-kubernetes-fips, dask-kubernetes, apache-beam-python-3.11-sdk,...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses spring-security-core-6.5.10.jar, form-data-4.0.5.tgz, ws-8.20.1.tgz, pythonmultipart-0.0.27-py3-none-any.whl, starlette-1.2.1-py3-none-any.whl, httpcore5-5.3.6.jar, httpcore5-h2-5.3.6.jar, mlflow-3.13.0-py3-none-any.whl, js-yaml-4.2.0.tgz and tar-7.5.16.tgz which ar...

com.walterjwhite.java.examples:ssh (0.0.17), com.walterjwhite.java.modules.linux-builder.modules.cli.providers:cdi (0.0.17) +24 more potentially affected by CVE-2026-13506 via org.bouncycastle:bcprov-ext-jdk14 (>=1.45, <=1.72)

org.bouncycastle:bcprov-ext-jdk14 MAVEN version =1.45, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-13506 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519021...

The vulnerability of Java Cryptography Libraries Bouncy Castle for Java FIPS and Bouncy Castle for Java LTS lies in their uncontrolled resource consumption, which allows attackers to cause service failures.

The vulnerability of Java Cryptographic Libraries, specifically Bouncy Castle for Java FIPS and Bouncy Castle for Java LTS, is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow attackers to cause service failures...