Security Bulletin: Multiple vulnerabilities that affects Cirata Symphony for IBM Big Replicate

Summary netty-resolver-dns, netty-codec-classes-quic, netty-codec-redis, spring-core, netty-codec-http2, netty-handler, spring-expression, netty-transport-sctp, netty-codec-http3, netty-codec-haproxy, micrometer-core, netty-transport-native-epoll, spring-boot-autoconfigure, netty-codec-http,...

CVE-2026-79362

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

Security Bulletin: IBM DB2 Developer extension is affected via vulnerability in spring-web(CVE-2026-22741)

Summary IBM DB2 Developer extension is affected via vulnerability in spring-webCVE-2026-22741 Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be...

CVE-2026-79362

Certain Woltlab products are vulnerable to Remote Code Execution (RCE) via Cache Poisoning in the WCF component. The vulnerability affects versions WCF >= 6.1.0 until = 6.2.0 until

CVE-2026-79362

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

CVE-2026-79362

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

CVE-2026-79362: Improper Control of Generation of Code

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

PT-2026-90043

Name of the Vulnerable Software and Affected Versions Woltlab Suite Core versions 6.1.0 through 6.1.22 Woltlab Suite Core versions 6.2.0 through 6.2.5 Description An authenticated low-privileged user can achieve remote code execution through cache poisoning. The issue occurs when...

EUVD-2026-76188

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

CVE-2026-79362

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

Fedora 45 : bind (2026-0adbf9c133)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0adbf9c133 advisory. Fixes multiple CVEs, without a rebase to newer version - Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 - Key Record using PRIVATEDNS...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

SummaryThe CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless of...

PYSEC-2026-3824 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

USN-8742-1: Netty vulnerability

It was discovered that Netty incorrectly validates the bailiwick of NS records. An attacker could possibly use this issue to facilitate DNS cache poisoning attacks...

USN-8742-1 netty vulnerability

It was discovered that Netty incorrectly validates the bailiwick of NS records. An attacker could possibly use this issue to facilitate DNS cache poisoning attacks...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

PT-2026-89731

It was discovered that Netty incorrectly validates the bailiwick of NS records. An attacker could possibly use this issue to facilitate DNS cache poisoning attacks...

Ubuntu 24.04 LTS : Netty vulnerability (USN-8742-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8742-1 advisory. It was discovered that Netty incorrectly validates the bailiwick of NS records. An attacker could possibly use this issue to facilitate DNS cache poisoning attack...

CVE-2026-87874 Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on...

CVE-2026-87874 Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on...