Security Bulletin:Vulnerabilities exists in NPS of IBM Netezza Appliance

Summary Vulnerabilities identified in NPS of IBM Netezza Software have been addressed in version 11.3.1.3-IF3. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...

CVE-2026-73276

A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...

SUSE CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...

EUVD-2026-69610

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials...

[SECURITY] [DSA 6490-1] fort-validator security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6490-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 08, 2026 https://www.debian.org/security/faq -...

Debian dsa-6490 : fort-validator - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6490 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6490-1 [email protected] https://www.debian.org/security/ Moritz...

NewStart CGSL MAIN 7.02 : bind Multiple Vulnerabilities (NS-SA-2026-0110)

The remote NewStart CGSL host, running version MAIN 7.02, has bind packages installed that are affected by multiple vulnerabilities: - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions...

NewStart CGSL MAIN 7.02 : unbound Multiple Vulnerabilities (NS-SA-2026-0095)

The remote NewStart CGSL host, running version MAIN 7.02, has unbound packages installed that are affected by multiple vulnerabilities: - NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that...

EUVD-2026-72537

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

OESA-2026-3660 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn...

OESA-2026-3659 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn fail...

OESA-2026-3658 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn fail...

Origin Validation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error leading to cache poisoning in the interceptors.cache and interceptors.deduplicate interceptors, which build cache and deduplication keys without t...

Security Bulletin: Vulnerability in Netty's DnsResolveContext affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty's DnsResolveContext has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional...

CVE-2026-85152

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...

DEBIAN-CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...