PT-2026-83059

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can send a crafted email with message header values designed to collide in an internal hash table. This causes the IMAP THREAD command to consume CPU resources disproportionate to the...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

K000163111: jq vulnerability CVE-2026-40164

Security Advisory Description jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed 0x432A9843 for all JSON object hash table operations, which allowed an attacker to precompute key collisions...

Security Bulletin: Vulnerability in Immutable.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Immutable.js has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Use of a Broken or Risky Cryptographic Algorithm

Overview Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to the extractContextHash logic in SemanticCacheAdvisor.java. An attacker can receive cached responses from an unrelated system prompt by sending requests whose prompts collide under...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099723)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099723 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6vti: fix incorrect tunnel matching in vti6tnllookup In vti6tnllookup, when an exact match for ...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100702)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100702 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6vti: fix incorrect tunnel matching in vti6tnllookup In vti6tnllookup, when an exact match for ...

AZL-96132 CVE-2026-74567 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyringgetkeychunk For description-level chunks keyringgetkeychunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

UBUNTU-CVE-2026-74567

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyringgetkeychunk For description-level chunks keyringgetkeychunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

CVE-2026-74315

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...

UBUNTU-CVE-2026-74315

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...

CVE-2026-47191

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

EUVD-2026-58719

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-10050

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration is vulnerable to Denial Of Service due to vulnerabilities in Immutable.js

Summary Platform Navigator in IBM Cloud Pak for Integration is vulnerable to Denial Of Service due to vulnerabilities in Immutable.js CVE-2026-59879, CVE-2026-59880. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many...

IBM Langflow OSS Code Execution Vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from the use of truncated SHA-256 hashes for code verification by the custom component validation mechanism. The hashi...

CVE-2026-9201: Inadequate Encryption Strength

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application...

DoS (Denial of Service) immutable Dependency in Jira Software Data Center

This DoS Denial of Service vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.1, 10.5.0, 10.6.0, 10.7.1, 11.0.0, and 11.1.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

CVE-2026-24255

NVIDIA Dynamo for Linux is affected by CVE-2026-24255 in the multimodal embedding cache. The issue arises when submitting images that share an identical pixel byte sequence but have different dimensions, potentially enabling data tampering via a hash collision. Affected product: NVIDIA Dynamo for...