CVE-2026-17416

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27 are vulnerable to arbitrary code execution by a local attacker due to insecure deserialization (CWE-502). The IBM security bulletin groups this CVE with two additional vulnerabilities: CVE-2026-17133 (OS...

CVE-2026-17416 IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-59570

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...

CVE-2026-59570 Android ZCC denial of service

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...

EUVD-2026-77540

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...

CVE-2026-59570 Android ZCC denial of service

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...

CVE-2026-59570

CVE-2026-59570 affects Zscaler Client Connector (ZCC) on Android , where a pre-installed peer application can tear down the Zscaler tunnel, force a user logout, and toggle packet capture. The primary impact is denial of service (tunnel disruption and forced logout), with additional integrity impa...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been resolved through improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. A malicious application may be able to leak sensitive user information...

Astra Linux – Vulnerability in docker.io-app

Moby version 25.0.3 has a race condition vulnerability in the StreamFormatter package. This vulnerability can be exploited to trigger multiple concurrent write operations, leading to data corruption or application crashes...

Astra Linux – Vulnerability in Chromium

In incorrect security user interfaces of web app installations in Google Chrome on Android before version 90.0.4430.212, an attacker who convinced a user to install a web application could inject scripts or HTML into a privileged page through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Before version 102.0.5005.61, using “after free” in the App Service in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted Chrome Extension...

Astra Linux – Vulnerability in containerd-app

Due to a missing nil check, sending HTTP/2 frames with values 0x0a-0x0f will cause a running server to panic...

Astra Linux – Vulnerability in Chromium

Before version 90.0.4430.212, using “after free” in Google Chrome’s payments functionality allowed an attacker who convinced a user to install a malicious payment app to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Tomcat9

URL redirection to untrusted sites “open redirect” vulnerability in FORM authentication with Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.0-M10, 10.1.0-M1 through 10.0.12, 9.0.0-M1 through 9.0.79, and 8.5.0 through 8.5.92. Older, end-of-life versions...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Android intents in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious application to obtain potentially sensitive information via a crafted HTML page...

Astra Linux – Vulnerability in docker.io-app

Moby v25.0.5 is affected by a race condition in the builder/builder-next/adapters/snapshot/layer.go file. This vulnerability could be exploited to trigger concurrent builds that invoke the EnsureLayer function, leading to resource leaks or exhaustion...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. Prior to version 29.3.1, a security vulnerability was detected that allowed attackers to bypass authorization plugins AuthZ. This issue has been fixed in version 29.3.1...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. Chromium security severity: Medium...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.27 and 13.5.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

CVE-2026-90616

A flaw was found in Flatpak. A malicious sandboxed application can exploit missing symlink protection during the creation and bind-mounting of app data directories. By manipulating attacker-controlled path components, a malicious symlink can redirect these directories to arbitrary locations on th...