Security Bulletin: IBM Maximo Application Suite uses python-ldap-3.4.4.tar.gz, werkzeug-3.1.4-py3-none-any.whl and werkzeug-3.1.3-py3-none-any.whl which is vulnerable to CVE-2025-61911, CVE-2025-61912, CVE-2026-27199 and CVE-2026-21860.

Summary IBM Maximo Application Suite uses python-ldap-3.4.4.tar.gz, werkzeug-3.1.4-py3-none-any.whl and werkzeug-3.1.3-py3-none-any.whl which is vulnerable to CVE-2025-61911, CVE-2025-61912, CVE-2026-27199 and CVE-2026-21860. This bulletin contains information regarding the vulnerability and its...

fr.cnieg.keycloak:attribute-login-provider (1.3.7), org.keycloak:keycloak-crypto-fips1402 (22.0.2) +13 more potentially affected by CVE-2026-37977 via org.keycloak:keycloak-services (22.0.2)

org.keycloak:keycloak-services MAVEN version 22.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.7 - org.keycloak:keycloak-crypto-fips1402 22.0.2 -...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism

Summary IBM Operations Analytics – Log Analysis is affected by weaknesses in its Backend Authentication and Session Management module—used as part of its login mechanism—which exposes the product to improper authentication risks, including weak password policy enforcement and insufficient account...

SUSE: Security Advisory (SUSE-SU-2026:20933-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

fr.cnieg.keycloak:attribute-login-provider (1.4.1), org.keycloak:keycloak-crypto-fips1402 (23.0.5) +13 more potentially affected by CVE-2026-4636 via org.keycloak:keycloak-services (23.0.5)

org.keycloak:keycloak-services MAVEN version 23.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.1 - org.keycloak:keycloak-crypto-fips1402 23.0.5 -...

com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider (1.0.0), io.github.pckhoi.keycloak:webhook (19.0.2.1) +19 more potentially affected by CVE-2026-4636 via org.keycloak:keycloak-services (19.0.2)

org.keycloak:keycloak-services MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider 1.0.0 -...

CVE-2026-29138 PGP Decryption Sender LDAP Injection

SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own...

CVE-2026-29138: Improper Neutralization of Special Elements used in an LDAP Query

SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own...

CVE-2026-29131: Improper Neutralization of Special Elements used in an LDAP Query

SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to read the contents of emails encrypted for other users...

PT-2026-48301

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description The ldapQueryPassword parameter, when configured using the runtime setParameter command, causes the new password to be recorded in plain text within the mongod.log file. Recommendations At th...

grafana security update

10.2.6-19 - Resolves RHEL-158728: CVE-2026-25679 10.2.6-17 - Resolves RHEL-144959: CVE-2026-21721 - Resolves RHEL-146863: CVE-2025-61726 - Resolves RHEL-147081: CVE-2025-61729 - Resolves RHEL-147370: CVE-2025-61728 - Resolves RHEL-149621: CVE-2025-68121 10.2.6-17 - Resolves RHEL-125692:...

Moderate: Red Hat Security Advisory: 389-ds:1.4 security update

An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Moderate. A Commo...

USN-8136-1 dovecot vulnerabilities

It was discovered that Dovecot incorrectly handled invalid base64 SASL data. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10. CVE-2025-59028 It was discovered that Dovecot script decode2text.sh incorrectly handled zip files. An attacke...

USN-8136-1: Dovecot vulnerabilities

It was discovered that Dovecot incorrectly handled invalid base64 SASL data. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10. CVE-2025-59028 It was discovered that Dovecot script decode2text.sh incorrectly handled zip files. An attacke...

Fedora: Security Advisory (FEDORA-2026-b2ec0d8a47)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 16 Security Update : python-ldap (openSUSE-SU-2026:20421-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20421-1 advisory. - CVE-2025-61911: Enforce str for escapefilterchars bsc1251912. - CVE-2025-61912: Escape NULs as per RFC 4514 in escapednchars bsc1251913. Tenab...

SUSE CVE-2026-33419

MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS Security Token Service AssumeRoleWithLDAPIdentity endpoint is vulnerable to LDAP credential brute-forcing due to two combined weaknesses: 1 distinguishable error responses that enable...

Linux Distros Unpatched Vulnerability : CVE-2026-27860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions...

Security update for python-ldap (moderate)

openSUSE security update: security update for python-ldap ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20421-1 Rating: moderate References: bsc1251912 bsc1251913 Cross-References: CVE-2025-61911 CVE-2025-61912 CVSS scores: CVE-2025-61911 SUSE : 6...

AZL-81716 CVE-2026-27860 affecting package dovecot 2.3.20-1

If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out authusernamechars, or install fixed version. No publicly available exploits are...