Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838

Summary IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Detai...

Security Bulletin: Due to use of WebSphere Application Server - Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for September 2026.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 26.0.0-IF003, 25.0.0-IF007 and 24.0.0-IF009. These vulnerabilities have been also addressed in 24.0.1-IF009 Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion through 5.0.7 is vulnerable to...

BIT-AUTHENTIK-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

thrift: Apache Thrift: Denial of Service via deeply nested unknown fields

A flaw was found in Apache Thrift. Multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a message containing deeply nested unknown fields, leading to stack...

UBUNTU-CVE-2026-103641

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader...

CVE-2026-103641

A flaw exists in GEGL where the Radiance HDR loader performs an out-of-bounds read . The vulnerability occurs when an uncompressed scanline in a memory-mapped image is shorter than the width specified in the file header. An attacker can cause an application using this loader to crash by providing...

EUVD-2026-90475

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader...

CLEANSTART-2026-QE04836 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...

Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...

CVE-2026-93832: Missing Authorization

A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps...

CentOS Linux 7 [TuxCare] Security Update: taglib / taglib-devel / taglib-doc (CENTOS7:CLSA-2026:1778161748)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778161748 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the...

AlmaLinux 9.2 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1747903683)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1747903683 advisory. - A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems li...

The vulnerability of the application software interface of the Cisco Catalyst SD-WAN Manager allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the application software interface of the Cisco Catalyst SD-WAN Manager is related to improper handling of data with encoded URLs. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and gain unauthorized access to protected information by...

AlmaLinux 9.2 [TuxCare] Security Update: libxslt / libxslt-devel (ALMALINUX9.2:CLSA-2026:1783418975)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783418975 advisory. - A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and...

AlmaLinux 9.2 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc (ALMALINUX9.2:CLSA-2026:1776941944)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776941944 advisory. - In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an applicatio...

PT-2026-103777

Name of the Vulnerable Software and Affected Versions ground-station versions prior to 0.8.0 Description An authentication bypass exists in the setup.restore command during the first-run setup mode. Unauthenticated attackers can use Socket.IO to invoke this command and execute arbitrary SQL,...

Rocky Linux 9.6 [TuxCare] Security Update: taglib / taglib-devel (ALMALINUX9.6:CLSA-2026:1777540469)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777540469 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk i...

AlmaLinux 9.2 [TuxCare] Security Update: openexr / openexr-devel / openexr-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784118526)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784118526 advisory. - An integer overflow could occur when OpenEXR processes a crafted file on systems where sizet 64 bits. This could cause an invalid...

PT-2026-105074

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

CVE-2026-103244: Missing Authentication for Critical Function

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session...