Security Bulletin: Multiple Vulnerabilities in IBM DevOps Release

Summary IBM DevOps Release 7.1.0.0 addresses multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphis...

Security update for python-tornado

This update for python-tornado fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClien...

SUSE-SU-2026:4404-1 Security update for python-tornado

This update for python-tornado fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...

Security update for python-tornado6

This update for python-tornado6 fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClie...

SUSE-SU-2026:4403-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...

CVE-2026-93996

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol ...

UBUNTU-CVE-2026-93996

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol ...

Resource Exhaustion

Apache Qpid Proton-J is vulnerable to resource exhaustion. The vulnerability is due to the inability to govern the maximum number of transfer frames per incoming delivery, where the library does not enforce a limit on the number of frames and an authenticated attacker can send deliveries with...

EUVD-2026-89754

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol ...

CVE-2026-93996

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol ...

Alternate Path Bypass

Apache Tika is vulnerable to an alternate path bypass. The vulnerability is due to improper protection of an alternate path, where the library does not properly validate alternate file paths and attackers can supply crafted paths to access unauthorized resources...

CVE-2026-102509 Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X PLC4J allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the O...

CVE-2026-102509 Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X PLC4J allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the O...

CVE-2026-102509

The Apache PLC4X (PLC4J) Java implementation is vulnerable to pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser . The root causes include memory allocation with excessive size values, allocation of resources without limits, and uncontrolled recursion. Specificall...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed in the Vulnerability Details section below. This bulletin provides information about the affected components and the...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses Websphere application which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses Websphere application which is vulnerable to CVE-2026-10842, CVE-2026-15057, CVE-2026-11897, CVE-2026-50645, CVE-2026-9322, CVE-2026-9171. This bulletin contains information addressing the vulnerability. Vulnerability Details...

CVE-2026-97969

A flaw was found in the Linux kernel's Mstar MSC313e watchdog driver. When adjusting the watchdog timeout setting, the driver unconditionally activates the timer even if the watchdog device is currently inactive. A local user with access to configure the watchdog device could exploit this flaw to...

CVE-2026-97952

A flaw was found in the Linux kernel's sunvdc Sun Virtual Disk Client driver, which can lead to a Denial of Service DoS. When transmitting a virtual disk request fails, the driver does not release or unmap the associated Logical Domain Channel LDC entries, causing a persistent resource leak. A...

Security Bulletin: This Power System update is being released to address CVE-2026-16678

Summary IBM Power Systems Firmware could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources due to improper resource management. Vulnerability Details CVEID:CVE-2026-16678 DESCRIPTION: IBM Power Systems Firmware could allow a remote authenticated...

EUVD-2026-89493

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...