UBUNTU-CVE-2026-54604

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and openslidetiffreadtile to request a full-height destination for a partial bottom tile row, allowing uninitialized...

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...

Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)

Summary Multiple vulnerabilities reported in tomcat-embed-core-10.1.57.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 10.1.57 is vulnerable to 9 CVEs covering improper access control, authentication bypass, TOCTOU race condition, improper authorization, improper...

[SECURITY] [DSA 6506-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6506-1 [email protected] https://www.debian.org/security/ Andres Salomon September 17, 2026 https://www.debian.org/security/faq -...

CVE-2026-69089

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:11+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-w3f4-8pj2-599w...

CVE-2026-69147

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:09+00:00| published-proof-of-concept| https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (Spyre)

Red Hat AI Base Images 3.3.3 Spyre is now available. Red Hat® AI Base Images...

Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point h...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.71 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.71 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

CLEANSTART-2026-AA21675 Security fix for CVE-2026-54516 applied in: activemq 6.1.8-r1, activemq 6.2.8-r1, activemq 6.3.1-r1, apache-nifi 2.10.0-r3, apache-nifi 2.9.0-r5, apache-nifi-registry 2.9.0-r3, confluent-kafka 8.3.0-r1, elasticsearch 9.4.4-r4, hazelcast 5.7.0-r1, kafka 4.3.1-r1, logstash-fips 9.4.3-r1, rundeck 6.0.0-r2, rundeck 6.0.1-r0, sonarqube 26.3.0.120487-r4, strimzi-kafka-operator 1.1.0-r1, trino 480-r7

CVE-2026-54516 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-44236

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...

EUVD-2026-80818

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser...

From guidance to action: Security fundamentals that materially reduce risk

AI has already made fundamental changes to the operating environment for cybersecurity. Cyberattackers are testing more paths, adapting their techniques, and moving across digital environments with greater speed and persistence. The weaknesses they exploit remain familiar: excessive permissions,...

CVE-2026-92078

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Security component...

CVE-2026-63460

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:13+00:00| published-proof-of-concept| https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7...

tomcat-coyote: tomcat: Improper Authorization allows security bypass

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...

tomcat: Apache Tomcat: Security constraint bypass for CGI scripts

A flaw was found in the CGI servlet component of Apache Tomcat. This vulnerability allows a security constraint bypass via improper handling of case sensitivity in the pathInfo component of a URI mapped to the CGI servlet...

Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended...

tomcat: security constraint bypass with HTTP/0.9

A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0...

tomcat: Apache Tomcat: Error condition not handled when configuring CRLs

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...