Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes sectio...

CLSA-2026-1784856216 TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 2.5.8-tuxcare.6...

CLSA-2026-1783386141 TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.11-tuxcare.4...

CLSA-2026-1783040457 TuxCare security update for @angular (15 CVEs)

TuxCare rebuilt 17 @angular packages to address 15 CVEs. Fixed in 15.0.3-tuxcare.2...

CLSA-2026-1781744131 TuxCare security update for fast-xml-parser (2 CVEs)

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.14.0-tuxcare.1...

CLSA-2026-1780879901 TuxCare security update for basic-ftp (2 CVEs)

TuxCare rebuilt basic-ftp to address 2 CVEs. Fixed in 5.0.5-tuxcare.1...

CLSA-2026-1779324473 TuxCare security update for postcss (4 CVEs)

TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.32-tuxcare.1...

CLSA-2026-1778805973 TuxCare security update for picomatch (2 CVEs)

TuxCare rebuilt picomatch to address 2 CVEs. Fixed in 2.3.1-tuxcare.1...

CLSA-2026-1777336758 TuxCare security update for timespan (1 CVE)

TuxCare rebuilt timespan to address 1 CVE. Fixed in 2.3.0-tuxcare.1...

CLSA-2026-1776904637 TuxCare security update for netmask (2 CVEs)

TuxCare rebuilt netmask to address 2 CVEs. Fixed in 1.0.6-tuxcare.1...

CLSA-2026-1774484512 TuxCare security update for deep-extend (1 CVE)

TuxCare rebuilt deep-extend to address 1 CVE. Fixed in 0.4.2-tuxcare.1...

CLSA-2026-1775175794 TuxCare security update for @angular (2 CVEs)

TuxCare rebuilt 19 @angular packages to address 2 CVEs. Fixed in 7.2.16-tuxcare.4...

CLSA-2026-1773360977 TuxCare security update for bootstrap (3 CVEs)

TuxCare rebuilt bootstrap to address 3 CVEs. Fixed in 3.4.1-tuxcare.1...

CLSA-2026-1773015253 TuxCare security update for com.google.guava (2 CVEs)

TuxCare rebuilt 4 com.google.guava packages to address 2 CVEs. Fixed in 27.1-android-tuxcare.1...

Important: dotnet10.0

Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

Important: python-pyasn1

Issue Overview: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily larg...

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access SMA 1000 series VPN appliances. In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activi...

CVE-2026-66402

A flaw was found in FreeRDP. This flaw involves multiple weaknesses in how FreeRDP validates TLS Transport Layer Security certificates. FreeRDP's custom validation logic can incorrectly process DNS Subject Alternative Name SAN values, accept Common Names without proper comparison to other SAN...

The vulnerability of the Azure Active Directory identity management and protection platform, related to deserialization mechanism flaws, allows attackers to trigger a service failure.

The vulnerability of the Azure Active Directory identity management and protection platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...