5572 matches found
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3. Vulnerability Details CVEID:CVE-2026-42013 DESCRIPTION: A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name SAN could cause the validation process to...
Johnson Controls Simplex Incident Manager
ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials passwords and authentication tokens from system memory, potentially leading to unauthorized access to the application and connected systems. 2. RECOMMENDED...
CVE-2026-17414
IBM PowerVM Hypervisor firmware (FW1120.00, FW1110.00–.30, FW1060.00–.80, FW950.00–.H2) has a CWE-20 improper input validation flaw in partition firmware during network boot. An unauthenticated adjacent attacker can block boot or substitute the boot image on partitions without OS secure boot (the...
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, stating they are being exploited in the wild. The shortcomings added to the KEV catalog are listed below - CVE-2026-65400 CVSS score: 9...
PT-2026-78476
This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data...
PT-2026-78475
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination...
CVE-2026-70888
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Access and security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracl...
CVE-2026-62454
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications...
Exploit for Code Injection in Anyscale Ray
CVE-2025-62593 — Ray Remote Code Execution unauthenticated...
CVE-2026-19671 Improper handling of highly compressed data (data amplification) in CISA Malcolm
Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...
CVE-2026-19671 Improper handling of highly compressed data (data amplification) in CISA Malcolm
Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...
CVE-2026-19671
Malcolm's safe-extract.py enforces decompression limits only on container archives (zip/tar/rar/7z) but not on single-stream formats (.gz/.xz/.lzma/.lz). An authenticated user can upload a small gzip bomb that decompresses unboundedly, exhausting the shared Docker volume used by OpenSearch, Logst...
CVE-2026-19671 Improper handling of highly compressed data (data amplification) in CISA Malcolm
Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...
CVE-2026-19670 Incorrect Authorization in CISA Malcolm
Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...
CVE-2026-19670 Incorrect Authorization in CISA Malcolm
Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...
CVE-2026-68820 is in KEV. Here Is What CISA BOD 26-04 Actually Requires Now
Executive Summary CVE-2026-68820 is an actively exploited Windows vulnerability listed in CISA’s Known Exploited Vulnerabilities KEV Catalog, with a remediation deadline as suggested by CISA BOD 26-04. CISA BOD 26-04 introduces risk-based remediation timelines ranging from 3 to 14 days, increasin...
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. Ray is an open-source, Python-native distributed computing framework designed to scale artificia...
CISA Malcolm
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...