Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13289)

Summary IBM MQ Managed File Transfer has addressed an XML external entity XXE vulnerability Vulnerability Details CVEID:CVE-2026-13289 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to...

OESA-2026-4625 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to...

OESA-2026-4583 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4582 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4581 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4580 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

Tornado: Event Loop Blocking And Excess Memory Use From Chunked Bodies With Many Small Chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

CVE-2026-90862: Progress Software WS_FTP Server: Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Improper authentication in the Web Transfer Module of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...

PT-2026-132326

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories...

Progress Software WS_FTP Server resource management error vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.7 and 2025.0.4 contain a resource management error vulnerability. This vulnerability stems from the backend receiving sessions without proper release in the Ad Hoc Transfer component, potentially leading to server resource exhaustion and...

CVE-2026-84294: Progress Software WS_FTP Server: Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to…

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories...

PT-2026-132106

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the...

CVE-2026-90870: Progress Software WS_FTP Server: A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server…

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

AlmaLinux 9.6 [TuxCare] Security Update: squid (ALMALINUX9.6:CLSA-2026:1793281224)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793281224 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

AlmaLinux 9.6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793303963)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793303963 advisory. - For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the...

Progress Software WS_FTP Server authorization issue vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.7 and 2025.0.4 contain an authorization issue vulnerability stemming from improper authentication in the Web Transfer Module. This vulnerability may allow attackers possessing the user’s password to access certain files associated with that...

Rocky Linux 9.6 [TuxCare] Security Update: squid (ALMALINUX9.6:CLSA-2026:1793281224)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793281224 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

Progress Software WS_FTP Server path traversal vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.6 and 2025.0.3 contain a path traversal vulnerability. This vulnerability stems from improper path name restrictions in the Ad Hoc Transfer component, potentially allowing authenticated users to access files outside the intended directory...

Linux Distros Unpatched Vulnerability : CVE-2026-93006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishe...

PT-2026-132338

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...