EUVD-2026-77540

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...

CVE-2026-59570 Android ZCC denial of service

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...

EUVD-2026-77537

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...

CVE-2026-59569 Android ZCC VPN API method privilege escalation

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...

CVE-2026-59569 Android ZCC VPN API method privilege escalation

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...

CVE-2026-59569

CVE-2026-59569 is an improper input validation vulnerability in Zscaler Client Connector (ZCC) on Android and ChromeOS , specifically in the VPN API method , that allows a local attacker with high privileges to potentially bypass Zscaler controls and escalate privileges. The CVSS v3.1 score is 8....

CVE-2026-25687 ZCC race condition in ZPA tunnel handler

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

EUVD-2026-77536

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

CVE-2026-25687

CVE-2026-25687 affects the ZPA tunnel handler in Zscaler Client Connector (ZCC) . A race condition in this component leads to a heap corruption , enabling a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process. The CVSS 3.1 score is 8.1 (HIGH...

CVE-2026-25687 ZCC race condition in ZPA tunnel handler

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the OIDC provider list process. An attacker can obtain sensitive configuration data, including client secrets, by querying the list of available OIDC providers as any authenticated...

CVE-2026-82428

The Apache Storm Client is vulnerable to cross-tenant dependency jar substitution due to predictable blob keys. When using the storm jar --artifacts feature, dependency artifacts are stored under keys derived solely from Maven coordinates (e.g., dep---.jar). Because these keys are predictable and...

CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...

CVE-2026-82431

The Apache Storm cluster is vulnerable to an authorization bypass in the SimpleACLAuthorizer component. The vulnerability occurs because the authorizer returns early when the nimbus.users list is empty, failing to evaluate the nimbus.groups list. Consequently, operators who configure access restr...

CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

CVE-2026-12985

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, and 11.7.x

CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

OPENSUSE-SU-2026:21846-1 Security update for keybase-client

This update for keybase-client fixes the following issues: Changes in keybase-client: - CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library Add update-go-crypto.patch to update affected dependency bsc1278586. - Update to go 1.26 as required ...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-13293)

Summary IBM MQ has addressed a bypass of the Java deserialization allowlist in the IBM MQ JMS client that could allow a remote authenticated attacker to execute arbitrary code on a system consuming JMS ObjectMessages Vulnerability Details CVEID:CVE-2026-13293 DESCRIPTION: IBM MQ could allow a...