Security Bulletin: Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access Vulnerability Details CVEID:CVE-2026-11927 DESCRIPTION: IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

MGASA-2026-0365 Updated perl-Net-OAuth packages fix security vulnerabilities

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire Net::OAuth versions before 0.3...

Malicious code in verify-contract-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7cfabb396e93e034caeb560ea029e3ca2bde784b8c713d5f8941a2b621dd36 The package ships a single bin entry bin/cli.js that, when invoked, runs whoami and POSTs the package name, username, hostname, and platform to a...

MAL-2026-15598 Malicious code in verify-contract-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7cfabb396e93e034caeb560ea029e3ca2bde784b8c713d5f8941a2b621dd36 The package ships a single bin entry bin/cli.js that, when invoked, runs whoami and POSTs the package name, username, hostname, and platform to a...

Malicious code in verify-contract-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1037ebeeb5eff8da3b46c8275a09151604157ddc24db244d76d27d97bfdddad bin/cli.js executes whoami and reads os.hostname / os.userInfo / os.platform, then POSTs those values to the hardcoded endpoint...

MAL-2026-15599 Malicious code in verify-contract-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1037ebeeb5eff8da3b46c8275a09151604157ddc24db244d76d27d97bfdddad bin/cli.js executes whoami and reads os.hostname / os.userInfo / os.platform, then POSTs those values to the hardcoded endpoint...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001391)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001391 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfsreftreemod after we...

CVE-2026-82243

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82243 Budibase Server before 3.41.3 SSRF with Credential Leakage

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82243 Budibase Server before 3.41.3 SSRF with Credential Leakage

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82243

Budibase Server before 3.41.3 is affected by a server-side request forgery (SSRF) vulnerability in the datasource verify endpoint . The root cause is that builder-level users can supply arbitrary URLs without SSRF validation, allowing them to make server-side requests to attacker-controlled hosts...

EUVD-2026-67695

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82243 Budibase Server before 3.41.3 SSRF with Credential Leakage

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82243: Server-Side Request Forgery (SSRF)

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

PT-2026-83095

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

PYSEC-2026-3960

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81694

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

PYSEC-2026-3960

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81690

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

PYSEC-2026-3796

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...