Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact. Information about security vulnerabilities affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details Refer...

Security Bulletin: JVM crash (SEGV) in IBM Java SDK affect IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact. Information about security vulnerability affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details Refer t...

CVE-2026-63127

RMCP is the official Rust SDK for the Model Context Protocol . Prior to version 2.0.0 , the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-...

CVE-2026-92299

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-92299

@jitsi/electron-sdk (the Electron-based desktop client for Jitsi Meet) prior to 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker. This allows any script running in the meeting page to call the jitsi-screen-sharing-get-sources IPC route and ...

EUVD-2026-80079

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-92215

CVE-2026-92215 affects a2ui-project a2ui versions up to 0.10.7 . The vulnerability is a Server-Side Request Forgery (SSRF) in the FileResolver component, specifically in the httpx.get function within the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py. An unaut...

SUSE CVE-2026-89090

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

PT-2026-93258

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

Oracle Linux 9 : .NET / 8.0 (ELSA-2026-67524)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67524 advisory. 8.0.131-1.0.1 - Add support for Oracle Linux 8.0.131-1 - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252247 Tenable has extracted the...

.NET 10.0 security, bug fix, and enhancement update

10.0.112-1.0.1 - Add support for Oracle Linux 10.0.112-1 - Update to .NET SDK 10.0.112 and Runtime 10.0.12 - Resolves: RHEL-252319...

ALSA-2026:68233 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

.NET 9.0 security, bug fix, and enhancement update

9.0.121-1.0.1 - Add support for Oracle Linux 9.0.121-1 - Update to .NET SDK 9.0.121 and Runtime 9.0.20 - Resolves: RHEL-252278...

Linux Distros Unpatched Vulnerability : CVE-2026-63128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in...

AlmaLinux 10 : .NET 9.0 (ALSA-2026:67528)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67528 advisory. dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability CVE-2026-58649 dotnet10.0: dotnet9.0: .NET Elevation of Privilege...

Oracle Linux 9 : .NET / 9.0 (ELSA-2026-67614)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67614 advisory. 9.0.121-1.0.1 - Add support for Oracle Linux 9.0.121-1 - Update to .NET SDK 9.0.121 and Runtime 9.0.20 - Resolves: RHEL-252278 Tenable has extracted t...

CVE-2026-81869: Improper Handling of Unicode Encoding

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...