Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2024-53161 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM...

CVE-2026-54454

The OpenCATS applicant tracking system is vulnerable to Authenticated Remote Code Execution (RCE) in the Import module (specifically modules/import/ImportUI.php) prior to version 0.10.0 . The root cause is that the module can preserve an uploaded file's original name and place it in a web-accessi...

DEBIAN-CVE-2026-79607

During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...

CVE-2026-96297

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory ca...

CVE-2026-79607

In Xen 4.22 , a vulnerability exists in Xenstore during a live update where the state record for a watch with a specified depth is written with two missing bytes. This oversight creates an inconsistent state upon reading the data in the new Xenstore, which can lead to wrong Xenstore data or a cra...

CVE-2026-79607 Xenstore: Guests can crash xenstored during Live Update

During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...

EUVD-2026-98823

During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...

CVE-2026-79607

During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data (CVE-2026-93905)

Summary IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data with the batchManagement-1.0 enabled. Vulnerability Details CVEID:CVE-2026-93905 DESCRIPTION: IBM WebSphere Application Server Liberty could allow an unauthenticated remote attacker to corrupt the...

CVE-2026-97334

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and...

CVE-2026-90259

A flaw was found in btrfs qgroup. An incorrect length calculation in the qgroupfreereserveddata function can lead to a much larger length being used than intended. This error in calculation may result in improper data handling, potentially causing system instability or data corruption. Mitigation...

CVE-2026-90244

A flaw was found in the Linux kernel. Specifically, within the iommu/dma component, a lack of proper locking in the VFIO type1 legacy container could allow concurrent access to the msipagelist. This concurrent access can lead to data corruption of the msipagelist, potentially causing system...

CVE-2026-90285

A flaw was found in the Linux kernel's scsi: qla2xxx component. A redundant read of the Vital Product Data VPD flash in the qla2x00sysfsreadvpd function occurs without the necessary locking mechanism. This exposes flash access to concurrent operations, which can lead to unpredictable behavior or...

CVE-2026-90332

A flaw was found in the Linux kernel's PCI dwc endpoint driver. This vulnerability occurs when the driver unmaps an Inbound Address Translation Unit iATU entry without ensuring that all pending Message Signaled Interrupts MSI writes have been flushed. This can lead to MSI writes being dropped or...

CVE-2026-90279

A flaw was found in the Linux kernel's md/raid5 component. Incorrect rounding of bitmap stripes during sector division in the raid5bitmapsectormap function can lead to an incorrect mapping of array ranges to component sectors. This issue can result in data corruption or unintended data access...

CVE-2026-90205

A flaw was found in ocfs2 within the Linux kernel. OCFS2 trusts active orphan slot data read from disk inodes without proper validation. A corrupted inode could lead to an out-of-bounds memory access when processing orphan slots, potentially causing system instability or a denial of service...

CVE-2026-11731 Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models

An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the...

CVE-2026-77362

Prior to version 1.3.1 , the obsidian-tc Model Context Protocol server for Obsidian vaults fails to consistently apply the read access-control list (ACL) to all returned fields. Specifically, the tasks_filter tool exposes group counts from denied notes, makemd_query passes unfiltered sibling resu...

Microsoft Trace Data Helper Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...

Microsoft Trace Data Helper Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...