OESA-2026-2693 mongo-c-driver security update

mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fixes: The bsonvalidate function may return early on specific inputs and...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.1.0 Vulnerability Details CVEID:CVE-2026-42033 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency...

Security update for libheif

This update for libheif fixes the following issues Update to 1.23.0: CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay via crafted HEIF that exercises the overlay image item bsc1255735. CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read bsc1259544...

SUSE-SU-2026:2622-1 Security update for libheif

This update for libheif fixes the following issues Update to 1.23.0: - CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay via crafted HEIF that exercises the overlay image item bsc1255735. - CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read...

Security update for iproute2

This update for iproute2 fixes the following issue CVE-2024-58251: denial of service via terminal escape sequences bsc1254324. Other updates: support display of bound but unconnected sockets bsc1204562 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods...

SUSE-SU-2026:2620-1 Security update for iproute2

This update for iproute2 fixes the following issue - CVE-2024-58251: denial of service via terminal escape sequences bsc1254324. Other updates: - support display of bound but unconnected sockets bsc1204562...

Expression Injection

Overview ch.qos.logback:logback-core is a logback-core module. Affected versions of this package are vulnerable to Expression Injection in the Janino-evaluated condition attribute of configuration elements, handled by IfModelHandler, whose denylist blocked only the literal new operator. A user wh...

PT-2026-52067

Name of the Vulnerable Software and Affected Versions Jellyfin versions 10.9.0 through 10.11.9 Description The POST '/ClientLog/Document' endpoint fails to sanitize the Client and Version fields within the Authorization header when saving client-uploaded log documents to the disk. An authenticate...

ROS-20260624-73-0049

The vulnerability in python-aiohttp is related to the failure to handle CR LF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

ROS-20260624-73-0033

The vulnerability in Netty is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

PT-2026-51806

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can...

Jenkins plugins Multiple Vulnerabilities (2026-06-24)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing...

ROS-20260624-73-0044

The vulnerability in python-aiohttp is related to the failure to handle CR LF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

ROS-20260624-73-0047

The vulnerability in python-aiohttp is related to the failure to handle CR LF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

ROS-20260624-73-0025

The vulnerability in Netty is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-52122

Name of the Vulnerable Software and Affected Versions ATEN Unizon affected versions not specified Description A directory traversal flaw exists in the uploadSSL method, where the system fails to properly validate user-supplied paths before performing file operations. This allows authenticated...

Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in log4j v2.25.3.

Summary IBM® Db2® federated server is affected by multiple vulnerabilities in log4j v2.25.3. Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including 2.25.3, fails to...

CVE-2026-54319

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference volumeId, which may also be a volume name was forwarded to the runner and used to build the host bind-mount source path without confinement. A...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the MoviePlaybackHandler and related handlers, which allow arbitrary file reads due to improper path validation. An attacker can gain full administrative access and execute arbitrary commands by exploiting a...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the getmediapath function. An attacker can access arbitrary files on the filesystem by supplying an absolute path as the filename parameter, which causes the application to bypass directory restrictions and serve...