CLSA-2025-1763597220 TuxCare security update for 38 packages (2 CVEs)

TuxCare rebuilt 38 packages to address 2 CVEs. Fixed in 9.0.50-tuxcare.1...

CLSA-2025-1765411677 TuxCare security update for 38 packages (1 CVE)

TuxCare rebuilt 38 packages to address 1 CVE. Fixed in 9.0.50-tuxcare.3...

UBUNTU-CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

CVE-2026-67303

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

CVE-2026-11536 IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector...

CVE-2026-11536

CVE-2026-11536 affects IBM WebSphere Application Server versions including 8.5 and 9.0 (SOAP/JMX connector). Connected documents confirm an RCE vulnerability via the SOAP/JMX/HTTP interface with CWE-502 (Deserialization of Untrusted Data) and IBM CVSS data (up to 8.8 base score in some bulletins;...

CVE-2026-9322

CVE-2026-9322 affects IBM WebSphere Application Server (WAS) 9.0, WAS 8.5, and WAS Liberty 17.0.0.3 through 26.0.0.7, which are vulnerable to a denial of service via a crafted HTTP request. The root cause is an Uncontrolled Resource Consumption vulnerability in WAS/Liberty handling certain HTTP r...

CVE-2026-10842

CVE-2026-10842 – Affects IBM WebSphere Application Server (Traditional) 8.5, 9.0 and WebSphere Application Server Liberty 17.0.0.3–26.0.0.7. The vulnerability is a remote attacker bypass of security constraints (authentication bypass, CWE-289). Reported base CVSS v3.1 score is 7.5 (NONE user inte...

WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.9.0 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Admin and Site Enhancements ASE Pro versions = 8.9.0...

Fedora 44 : valkey (2026-3d18a65cc4)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3d18a65cc4 advisory. Valkey 9.0.5 - Released Tue 21 July 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible...

Linux Distros Unpatched Vulnerability : CVE-2026-14643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no- cache or private Cache-Control directive. In undici...

DEBIAN-CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-24033 Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...

Linux Distros Unpatched Vulnerability : CVE-2026-13697

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response...

CVE-2026-47219

CVE-2026-47219 : The vulnerability affects the find-my-way HTTP router. Versions before 9.7.0 are susceptible to remotely triggerable DoS when used with Node's HTTP/2 server. The issue arises because lookup() passes req.method to find(), and find() indexes this.trees[method]. Since this.trees is ...

CVE-2026-15325

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests...

CVE-2026-14515

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack...

CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

CVE-2026-14515 IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack...