[SECURITY] [DLA 4645-1] cloud-init - correct sources.list generation

------------------------------------------------------------------------- Debian LTS Advisory DLA-4645-1 [email protected] https://www.debian.org/lts/security/ Noah Meyerhans June 24, 2026 https://wiki.debian.org/LTS -...

Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-0994 DESCRIPTION: A...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to vulnerability in Marked

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to vulnerability in Marked. CVE-2026-41680 The vulnerability have been addressed. Vulnerability Details CVEID:CVE-2026-41680 DESCRIPTION: Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of...

curl: curl: Insecure connection establishment due to TLS configuration mismatch

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security TLS configuration of the new transfer does not match the existing connection,...

OESA-2026-2723 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies...

OESA-2026-2725 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies...

OESA-2026-2724 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies...

OESA-2026-2732 mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...

BIT-NIFI-2026-54665 Apache NiFi: Missing Validation for Proxy Host Headers

Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...

BIT-NIFI-2026-44914 Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not...

BIT-NIFI-2026-44913 Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not...

BIT-NIFI-2026-44911 Apache NiFi: Incorrect Authorization for Configuration Verification Requests

Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined...

SUSE-SU-2026:2615-1 Security update for tar

This update for tar fixes the following issues: Upgrade tar to version 1.34 jscPED-16073. Security issues fixed: - CVE-2025-45582: file overwrite via directory traversal in crafted TAR archives bsc1246399. Other updates and bugfixes: Changes from 1.28: - New --one-top-level option: extract all...

wrong STARTTLS connection reuse

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...

Expression Injection

Overview ch.qos.logback:logback-core is a logback-core module. Affected versions of this package are vulnerable to Expression Injection in the Janino-evaluated condition attribute of configuration elements, handled by IfModelHandler, whose denylist blocked only the literal new operator. A user wh...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and ifix. Vulnerability Details CVEID:CVE-2026-1605 DESCRIPTION: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP...

PT-2026-51745

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists where a new transfer utilizing STARTTLS to upgrade the connection may incorrectly reuse an existing live connection despite a mismatch in the TLS...

dracut security update

057-115.git20260527.0.1 - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the kernel. Orabug: 38705580 - Ship Oracle IMA certificate Orabug: 35992862 - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate Orabug: 35992862 -...

HPESBNW05073 rev.1 - HPE Telco Unified Correlation and Automation (UCA), Multiple Vulnerabilities

Potential Security Impact: Local: Input Validation; Remote: Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified Correlation Analyzer UCA Older than 4.4.10 - Fixed in version UCA 4.4.10 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

RHEL 9 : python3.14 (RHSA-2026:28247)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28247 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...