SUSE CVE-2026-90333

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

EUVD-2026-83983

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

CVE-2026-75939

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0  by vulnerabilities in uuid

Summary Security Bulletin:Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in uuid, IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of...

CVE-2026-80230

A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connection...

CVE-2026-75939

CVE-2026-75939 affects openshift/oc-mirror , where the PGP release image signature verification incorrectly checks for signature errors before the entire signed body is consumed. This ordering flaw allows a remote attacker who intercepts or manipulates traffic to the signature endpoint to craft a...

EUVD-2026-83904

MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processi...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

CVE-2026-59305

A flaw was found in Spring Cloud Stream. A partition interceptor may be improperly added when messages are sent. This could lead to unexpected behavior or incorrect message processing within the application, potentially affecting message routing or data integrity. Mitigation Mitigation for this...

CVE-2026-59306

A flaw was found in Spring Cloud Stream. This vulnerability involves the potential for deserialization of untrusted data. An attacker with high privileges and user interaction could exploit this to potentially impact the confidentiality and integrity of data. Mitigation To mitigate this issue,...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-6322)

Summary An IPv6 parsing validation bypass vulnerability in the fast-uri library CVE-2026-6322 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encod...

curl: curl: Cookie injection via malicious HTTP server using super cookies

A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...

The vulnerability of the ocsp_responders() function in the openssl/src/x509/mod.rs module of the OpenSSL library allows a attacker to influence the integrity of the protected information.

The vulnerability of the ocspresponers function in the openssl/src/x509/mod.rs library of the OpenSSL library is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

PT-2026-96112

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Container Platform 4 affected versions not specified Description A flaw in the oc-mirror tool allows for the bypass of PGP Pretty Good Privacy release image signature verification. The tool incorrectly checks for signature...

ROS-20260921-73-0079

The vulnerability is related to the lack of integrity checks. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-63373: Cross-Site Request Forgery (CSRF)

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

CVE-2026-94374: Authorization Bypass Through User-Controlled Key

MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processi...

PT-2026-96159

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description The OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java fails to compare stateToken and cookieToken when IS GAE is false, impacting self-hosted Docker and WAR deployments. This...

PT-2026-96093

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description An insecure direct object reference exists in the processModuleResultsData function of the Event model. When processing module results, the system fails to unset the client-supplied id field for...

Linux Distros Unpatched Vulnerability : CVE-2026-80110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string...