Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-24486, CVE-2026-40347, CVE-2026-42561)

Summary Multiple vulnerabilities including path traversal and Denial of Service in the python-multipart streaming parser library CVE-2026-24486, CVE-2026-40347, CVE-2026-42561 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32. Vulnerabili...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in DOMPurify (CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914)

Summary Multiple HTML sanitization and mutation Cross-Site Scripting mXSS vulnerabilities in the DOMPurify library CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914 used by IBM InfoSphere Optim Archive...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-13676)

Summary A domain label parsing boundary vulnerability in the fast-uri URI parsing library CVE-2026-13676 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1...

CVE-2026-77423: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

PT-2026-97504

Name of the Vulnerable Software and Affected Versions JLine versions 3.0.0 through 3.30.14 JLine versions 4.x through 4.3.0 Description The built-in less viewer in this Java library for console input passes user-controlled search and display-filter patterns from the getPatternboolean...

PT-2026-97687

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.11 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 Description An issue exists where improper sanitization of path components in the merge request diff viewer could allow an...

CVE-2026-77987

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

EUVD-2026-84872

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987

A server-side request forgery (SSRF) vulnerability exists in the notebook viewer of GitHub Enterprise Server (versions 3.17 through 3.22). The root cause is the failure to validate the port of user-supplied URLs, despite validating the scheme and host. This allows requests to internal services on...

CVE-2026-75608

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75608 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

EUVD-2026-84531

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75608 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-75607 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware...

EUVD-2026-84530

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware...

[SECURITY] Fedora 45 Update: swayimg-5.6-2.fc45

Swayimg is a lightweight image viewer for Wayland display servers...

PT-2026-96790

Name of the Vulnerable Software and Affected Versions Frigate versions prior to 0.17.2 Description The WebSocket handler in frigate/comms/ws.py forwards message topics to the dispatcher without verifying the authenticated user's role. This occurs because the nginx authentication subrequest lacks...

PT-2026-96791

Name of the Vulnerable Software and Affected Versions Frigate versions prior to 0.18.0 Description An authentication bypass exists where the prefix-matched location '/api/go2rtc/api' requires authentication but fails to enforce an administrator role for GET requests. This exposes the proxied go2r...