Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146972)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146972 advisory. A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts...

CVE-2026-6647

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-6647

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-6647 Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

EUVD-2026-112401

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-3583

When the "allowedscopes" configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be return...

CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, "nora-registry" authenticates the token-management UI but fails to require administrator authorization. "authmiddleware" protects "/ui/tokens" and "/api/ui/tokens", but state-changing requests are checked only with...

EUVD-2026-112076

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

CVE-2026-59164 NORA missing cross-user token-management authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

CVE-2026-59164 NORA missing cross-user token-management authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

CVE-2026-59164 NORA missing cross-user token-management authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

CVE-2026-59164

The NORA self-hosted artifact registry (versions prior to 0.9.5 ) contains a missing authorization vulnerability in the nora-registry component. While the auth_middleware() protects the token-management UI, it fails to enforce administrator authorization for state-changing requests, checking only...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-73581,CVE-2026-75973,CVE-2026-77756,CVE-2026-77762,CVE-2026-78383,CVE-2026-78437,CVE-2026-86350)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-73581,CVE-2026-75973,CVE-2026-77756,CVE-2026-77762,CVE-2026-78383,CVE-2026-78437,CVE-2026-86350 Vulnerability Details CVEID:CVE-2026-73581 DESCRIPTION: Improper Check for Certificate Revocation...

Vulnerability related to session mechanism issues in WSO2 Identity Server

Versions 7.2.0 through 7.2.0.21 of WSO2 Identity Server and versions 7.0.385 through 7.0.385.17 of WSO2 Carbon OAuth contain a session mechanism vulnerability. This vulnerability stems from inconsistent handling of usernames in uppercase and lowercase between user storage that is case-insensitive...

CVE-2026-59164: Missing Authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

PT-2026-129164

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

PT-2026-128248

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth middleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can...

WSO2 API Manager session mechanism vulnerability

Versions 3.1.0 through 3.1.0.367, 3.2.0 through 3.2.0.475, 3.2.1 through 3.2.1.106, 4.0.0 through 4.0.0.394, 4.1.0 through 4.1.0.267, 4.2.0 through 4.2.0.207, 4.3.0 through 4.3.0.120, 4.4.0 through 4.4.0.83, 4.5.0 through 4.5.0.67, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.3 contain a sessi...

CVE-2026-6647: WSO2: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for…

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...