Important: java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fixes: JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance XBM...

CVE-2026-61277

...

CVE-2026-61174

CVE-2026-61174 affects Oracle Product Lifecycle Analytics (Oracle Supply Chain), specifically the Installation Issues component in version 3.6.1. The issue allows a locally authenticated, non-privileged user to compromise the analytics product, with potential unauthorized read/write access to dat...

CVE-2026-61123

...

CVE-2026-61023

...

CVE-2026-60900

...

CVE-2026-60817

...

CVE-2026-60701

...

CVE-2026-60646

CVE-2026-60646 affects Oracle WebCenter Content (Web Content Management) in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is exploitable by a low-privileged, network-accessible attacker over HTTP and requires user interaction; successful exploitation...

CVE-2026-60193

CVE-2026-60193 – MySQL Connectors (Connector/Net) : A vulnerability in Oracle MySQL Connector/Net within MySQL Connectors affects versions 9.7.0–9.7.1. It allows a low-privilege, network-accessing attacker (across multiple protocols) to compromise MySQL Connectors, with potential impact on additi...

CVE-2026-55081

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

MINI-J622-WFVX-PVMR

Bulletin has no description...

K000162353: Apache Tomcat vulnerabilities CVE-2026-59083 and CVE-2026-59084

Security Advisory Description CVE-2026-59083 Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56,...

PT-2026-62075

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get doc and update doc tools...

libtiff security, bug fix, and enhancement update

4.6.0-8.4 - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 RHEL-189374 - make sure documentation is updated during build for CVE-2023-52355 RHEL-178281 4.6.0-8.3 - reintroduce ignore option -i as it is required for tests RHEL-185328 4.6.0-8.2 - backport...

MINI-HCQR-5752-V68J

Bulletin has no description...

Oracle Linux 10 : cockpit (ELSA-2026-21676)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-21676 advisory. 356.2-1.0.1 - Storage: Enable btrfs support Orabug: 37464632 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop...

CVE-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetchapifydocs.ts validates allowlisted documentation domains with...

CVE-2026-59860

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an...

CVE-2026-59862

Kiota Python generator vulnerability (CVE-2026-59862): before version 1.32.0, attacker-controlled x-ms-enum.values[].description could flow into KiotaBuilder.SetEnumOptions and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, enabling generated inline comme...