Security Bulletin: Security vulnerability found in the Red Hat Universal Minimal Base Image shipped with CICS Transaction Gateway for Multiplatforms.

Summary A sensitive information exposure is found in the Red Hat Universal Base Image Minimal shipped with CICS Transaction Gateway for Multiplatforms. The CICS Transaction Gateway for Multiplatforms container has been updated to address the vulnerability. Vulnerability Details IBM X-Force ID:...

Security Bulletin: Security vulnerabilities found in the Red Hat Universal Minimal Base Image shipped with CICS Transaction Gateway for Multiplatforms

Summary Security vulnerabilities found in the Red Hat Universal Base Image Minimal shipped with CICS Transaction Gateway for Multiplatforms. This fix resolves these vulnerability CVE-2024-28757, CVE-2025-59375, CVE-2025-5372. Vulnerability Details CVEID:CVE-2024-28757 DESCRIPTION: libexpat throug...

Multi-Agent End-To-End Vulnerability Management for Mitigating Recurring Vulnerabilities

Software vulnerability management has become increasingly critical as modern systems scale in size and complexity. However, existing automated approaches remain insufficient. Traditional static analysis methods struggle to precisely capture contextual dependencies, especially when vulnerabilities...

EUVD-2026-4601

C++ HTTP Server is an HTTP/1.1 server built to handle client connections and serve HTTP requests. Versions 1.0 and below are vulnerable to Path Traversal via the RequestHandler::handleRequest method. This flaw allows an unauthenticated, remote attacker to read arbitrary files from the server's...

WordPress plugin GZSEO has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

femtocrux (0.2.2), meteva (>=1.7.3, <=1.8.0.1) +3 more potentially affected by CVE-2026-0994 via protobuf (3.20.0rc2)

protobuf PYPI version 3.20.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - femtocrux 0.2.2 - meteva =1.7.3, =0.1.0, =0.0.2, =0.5.2, =1.0.0a8 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.8.4) +1 more potentially affected by CVE-2026-0770 via lfx (>=0.1.13, <=0.3.4)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.8.4 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-0770 Source advisory: SNYK:PYTHON-LFX-15091579...

CVE-2025-13921: Missing Authorization

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capability check on the 'wedocsuserdocumentationhandlingcapabilities' function in all versions up to, and including, 2.1.1...

Sigstore framework path traversal vulnerability

The sigstore framework is an open-source Go language library developed by sigstore. Versions of the sigstore framework starting from 1.10.3 and earlier contained a path traversal vulnerability. This vulnerability stemmed from the lack of verification that the generated file paths remained within...

Fedora: Security Advisory (FEDORA-2026-23d669bf94)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Android Frameworks Base Privilege Escalation

The vulnerability of the NotificationStation.java file in the Android operating system is related to a violation of data protection mechanisms. Exploiting this vulnerability can allow an attacker, who operates remotely, to enhance their privileges...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004888)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004888 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: fix potential memory leak in setupbasectxt setupbasectxt allocates a memory chunk for...

Container and Containerization archive extraction does not guard against escapes from extraction base directory.

Summary The ArchiveReader.extractContents function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system...

CVE-2025-12781

A flaw was found in the base64 module in the Python standard library. The b64decode, standardb64decode and urlsafeb64decode functions will always accept the '+' and '/' characters even when an alternative base64 alphabet is specified via the altchars parameter that excludes them. This input...

easyvvuq (>=0.5.2.1, <=0.5.2.2), feature-engine (0.3.0) +11 more potentially affected by CVE-2025-71176 via pytest (4.3.1)

pytest PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - easyvvuq =0.5.2.1, =0.0.3, =0.1.3, =0.10.7, =2019.3.12, =0.0.11, =0.1.2, =0.1.0.dev2210, =0.1.1 Source cves: CVE-2025-71176 Source advisory:...

CVE-2026-24006

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a depthLimit parameter in...

Container and Containerization archive extraction does not guard against escapes from extraction base directory.

The ArchiveReader.extractContents function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using...

Fedora: Security Advisory (FEDORA-2026-e50e41fcea)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-21852

Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets...

EUVD-2026-3597

Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets...