Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openssl-fips-provider: openssl-fips-provider-3.0.7-1.2.hum1 aarch64, x8664 openssl-fips-provider-so-3.0.7-1.2.hum1 aarch64, x8664 openssl-fips-provider-3.0.7-1.2.hum1.src src...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-snapshotter-fips, crossplane-provider-aws-kms-fips, crossplane-provider-aws-cloudfront, crossplane-provider-aws-opensearch-fips, addon-resizer, kube-mgmt, crossplane-provider-aws-vpc-fips, drone-fips, eck-operator-fips, plugin-barman-cloud,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-snapshotter-fips, crossplane-provider-aws-kms-fips, crossplane-provider-aws-cloudfront, crossplane-provider-aws-opensearch-fips, addon-resizer, kube-mgmt, crossplane-provider-aws-vpc-fips, drone-fips, eck-operator-fips, plugin-barman-cloud,...

HP Dock Accessory WMI Provider Installer Security Update

A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability. HP has identified...

Self-Correcting Structured Output in Spring AI 2.0

Large language models are text-in, text-out systems — their interface is natural language. Natural language is a great interface for humans and a poor one for software. The moment downstream code needs to route on a field, persist a value, or branch on a result, the conversation has to become a...

PT-2026-51607

Name of the Vulnerable Software and Affected Versions Poweradmin versions prior to 4.2.4 Poweradmin versions prior to 4.3.3 Description Poweradmin is a web-based DNS administration tool for PowerDNS server. The software uses the attacker-controlled HTTP HOST request header as the authoritative...

Security update for terraform-provider-local, terraform-provider-null

This update for terraform-provider-local, terraform-provider-null fixes the following issue CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265658. Patch Instructions: To install this SUSE update use the SUSE recommended installati...

RHSA-2026:27744 Red Hat Security Advisory: openssl-fips-provider security update

Bulletin has no description...

RHSA-2026:27746 Red Hat Security Advisory: openssl-fips-provider security update

Bulletin has no description...

RHSA-2026:27745 Red Hat Security Advisory: openssl-fips-provider security update

Bulletin has no description...

Moderate: Red Hat Security Advisory: openssl-fips-provider security update

An update for openssl-fips-provider is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: openssl-fips-provider security update

An update for openssl-fips-provider is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: openssl-fips-provider security update

An update for openssl-fips-provider is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the OIDC authenticator. An attacker can gain access to the API by presenting a JWT that a shared identity provider issued for an unrelated service, because the token's audience aud claim is not validated. This...

Exploit for CVE-2026-54761

CVE-2026-54761: Traefik Kubernetes Gateway crossProviderNamesp...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Aspera Transfer Cluster Manager, faspex on Demand, Server on Demand, Application Platform on

Question Security Bulletin: Vulnerabilities in OpenSSL affect IBM Aspera Transfer Cluster Manager, faspex on Demand, Server on Demand, Application Platform on Demand, and Azure on Demand. CVE-2016-2107, CVE-2016-2106, CVE-2016-2176 "Business Unit":"code":"BU059","label":"IBM Software w/o...

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint RFC 7662, it decodes the response into an introspectResp struct. However, the...

PraisonAI: Compute-bridged file tools allow shell command injection

Compute-bridged file tools allow shell command injection Summary LocalManagedAgent / SandboxedAgent compute bridging wraps readfile, listfiles, and writefile when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the JWT validation process. An attacker can gain unauthorized access by presenting a validly signed token from a trusted issuer, originally intended for a different service, to the authentication system. This ...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the JWT validation process. An attacker can gain unauthorized access by presenting a validly signed token from a trusted issuer, originally intended for a different service, to the authentication system. This ...