crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by vulnerabilities in bouncy castle

Summary Bouncy Castle for Java before 1.85 was affected with the following CVE's.CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, CVE-2026-13586, CVE-2026-14682, CVE-2026-15055, CVE-2026-58059, CVE-2026-58060, CVE-2026-58061, CVE-2026-58062, CVE-2026-58063,...

ROS-20260915-73-0023

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260915-73-0118

The vulnerability of the History component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially created HTML page...

ROS-20260915-73-0027

The vulnerability of the Media Session component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially crafted HTML page...

ROS-20260915-73-0194

The vulnerability of the GetUserMedia component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to compromise data integrity through a specially crafted HTML page...

PT-2026-91935

Name of the Vulnerable Software and Affected Versions pig versions prior to 4.1.0 Description An authentication bypass exists in the '/register/password' endpoint. The system discards the results of the current password verification, which allows any value to be accepted as the current password...

CVE-2026-12354: Improper Control of Dynamically-Managed Code Resources

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to...

CVE-2026-58200: Improper Verification of Cryptographic Signature

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-91923: Server-Side Request Forgery (SSRF)

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...

CVE-2026-50166: Improper Certificate Validation

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

ROS-20260915-73-0075

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0013

The vulnerability of the DataTransfer component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-93186

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd write allowing forged firmware authenticity checks. Attackers can exploit put file.cgi and check image uuid.c to bypass firmware signature validation and load unauthorized firmware images...

ROS-20260915-73-0157

The vulnerability of the SVG component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260915-73-0057

The vulnerability of the confidentiality function of Fenced Frames in Microsoft Edge and Google Chrome is related to a lack of verification mechanism for the source of the data. Exploiting this vulnerability can allow attackers to bypass existing security measures remotely...

ROS-20260915-73-0040

The vulnerability of the MHTML component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260915-73-0045

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260915-73-0039

The vulnerability of the Network component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These vulnerabilities have been addressed in IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.22. Vulnerability Details CVEID:CVE-2026-41417...