PT-2026-85549

Name of the Vulnerable Software and Affected Versions sift sift.js versions prior to 17.1.4 Description The software enumerates query keys using a for...in loop, which traverses the object prototype chain and dispatches matched operator keys, including $where. The $where operation compiles a stri...

Linux Distros Unpatched Vulnerability : CVE-2026-76175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator...

CVE-2026-19283: Incorrect Authorization

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

NVIDIA Tegra Heap Buffer Overflow DoS

The vulnerability of the tegra124emcpreparetimingchange function in the drivers/memory/tegra/tegra124-emc.c module of the NVIDIA Tegra system controller driver is related to the use of an erroneous operator. Exploiting this vulnerability could allow a remote attacker to compromise the...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.4. Vulnerability Details CVEID:CVE-2026-11822 DESCRIPTION: SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process...

CVE-2026-85441 MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length

MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, ruby3.2-rails, ruby3.3-rails, ruby4.0-rails, pact-broker-docker-fips, pact-broker-docker, ruby3.4-rails, gitlab-rails-ce-fips, kube-logging-operator...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, ruby3.2-rails, ruby3.3-rails, ruby4.0-rails, pact-broker-docker-fips, pact-broker-docker, ruby3.4-rails, gitlab-rails-ce-fips, kube-logging-operator...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.2-rails, ruby3.4-rails, kube-logging-operator, ruby4.0-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.2-rails, ruby3.4-rails, kube-logging-operator, ruby4.0-rails...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.2-rails, ruby3.4-rails, kube-logging-operator, ruby4.0-rails...

EUVD-2026-70467

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload the authentication field of MqttRequestTemplate and treats its Subject...

CVE-2026-82180

Eclipse Arrowhead versions 5.0.0 through 5.2.1 are affected when the MQTT API is enabled with the certificate authentication policy. The CertificateMqttFilter decodes an X.509 certificate from the MQTT message payload using CertificateFactory.generateCertificate() but never verifies its signature...

CVE-2026-82180

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload the authentication field of MqttRequestTemplate and treats its Subject...

DEBIAN-CVE-2026-76177

Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...

UBUNTU-CVE-2026-76176

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76177

Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...

CVE-2026-76175

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

UBUNTU-CVE-2026-76175

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-5450 DESCRIPTION: Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to version 2.43 with a format wid...