PT-2026-73385

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

Unity Linux 20.1070e Security Update: log4j (UTSA-2026-099531)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099531 advisory. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue...

PT-2026-76684

Name of the Vulnerable Software and Affected Versions new-api versions prior to 1.0.0-rc.7 Description An information disclosure issue exists in the admin user list and user lookup APIs, specifically the 'GET /api/user/' endpoint. The system serializes User.AccessToken as access token because use...

UBUNTU-CVE-2026-74561

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-72340

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

CVE-2026-74343 kernfs: fix xattr race condition with multiple superblocks

In the Linux kernel, the following vulnerability has been resolved: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with different namespaces can share the same kernfsnode when kernfstestsuper finds a matching root but different namespace. This means multiple inode...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73846

The CVE describes a vulnerability in CKAN MCP Server prior to version 0.4.112 where canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters. This causes different logical parameter sets used by buildCacheKey to coll...

CVE-2026-73416 vulnerabilities

Vulnerabilities for packages: tensorflow-cpu-jupyter...

JLSEC-2026-1282

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing...

PT-2026-80524

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing...

Security Bulletin:Vulnerability in Log4j affects IBM Netezza Appliance

Summary The Log4j package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-49844 Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

CVE-2026-72925

CVE-2026-72925 affects SWC’s HTML minification path. The issue in minifyJson within crates/swc_html_minifier/src/lib.rs allowed attacker-controlled JSON inside application/json and application/ld+json script elements to be parsed/serialized without proper HTML escaping, enabling a closing script ...

PT-2026-70937

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

CVE-2026-11812 UpdateHub: race condition on shared context causes out-of-bounds write and DoS

The UpdateHub management subsystem subsys/mgmt/updatehub/updatehub.c drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds1. Access to ctx was not serialized, and preparef...