ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=6.9.5, <=6.9.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.9.5, <=6.9.8) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version =6.9.5, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: OSV:GHSA-7CMJ-V6X8-FRVV...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=6.9.5, <=6.9.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.9.5, <=6.9.8) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version =6.9.5, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: OSV:GHSA-7CMJ-V6X8-FRVV...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=6.9.5, <=6.9.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.9.5, <=6.9.8) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version =6.9.5, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: GHSA-7CMJ-V6X8-FRVV...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=6.9.5, <=6.9.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.9.5, <=6.9.8) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version =6.9.5, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-17912728...

GHSA-7CMJ-V6X8-FRVV org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource...

health.matchbox:matchbox-engine (>=4.1.8, <=4.1.10), org.hl7.fhir.publisher:org.hl7.fhir.publisher (>=2.2.7, <=2.2.8) +2 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.9.7, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version =6.9.7, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: OSV:GHSA-7CMJ-V6X8-FRVV...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.116), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.116) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.116)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.116 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.116 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.116), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.116) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.6.116)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.6.116 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.116 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=6.9.5, <=6.9.8), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support (>=6.9.5, <=6.9.8) +5 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version =6.9.5, =6.9.5, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: GHSA-7CMJ-V6X8-FRVV...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=6.9.5, <=6.9.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.9.5, <=6.9.8) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version =6.9.5, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: GHSA-7CMJ-V6X8-FRVV...

au.csiro.pathling:encoders (>=9.6.0, <=9.7.1), au.csiro.pathling:fhirpath (>=9.6.0, <=9.7.1) +9 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version =6.9.5, =9.6.0, =9.6.0, =9.6.0, =9.6.0, =9.6.0, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: GHSA-7CMJ-V6X8-FRVV...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.116), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.116) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.116)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.116 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.116 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=6.9.5, <=6.9.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.9.5, <=6.9.8) +4 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (>=6.9.5, <=6.9.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version =6.9.5, =6.9.5, =6.9.5, =4.1.8, =2.2.7, =2.2.7, =2.2.7, =2.2.8 Source cves: CVE-2026-49485 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-17912729...

Microsoft fixes RoguePlanet zero-day in Defender

Microsoft issued a security update that fixes the zero-day vulnerability known as RoguePlanet in Microsoft Defender. RoguePlanet is tracked as CVE-2026-50656, a Microsoft Defender elevation of privilege EoP vulnerability. As we reported last month, if successfully exploited, RoguePlanet can allow...

Important: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.4

Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.10.4 General Availability release, with updates to container images. Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.10.4 release that simplify the process of...

Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges

Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public. The vulnerability, tracked as CVE-2026-50656 CVSS score: 7.8, is a privilege escalation issue in the Microsoft Malware Protection Engine "mpengine.dll...

Meta's New AI Image Tool Lets Others Use Your Public Instagram Photos in AI Images

Meta has announced that its new artificial intelligence AI model Muse Image lets people use public Instagram posts and reels to generate AI content, and it's enabled by default. "You can also @-mention Instagram accounts in the Meta AI app to bring specific Instagram profiles right into your...

EUVD-2026-42478

Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource...

CVE-2026-57022: Improper Check for Unusual or Exceptional Conditions

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. When an affected device initiates a TCP...