CVE-2026-115502

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps...

HAPI FHIR

RISK EVALUATION SmileCDR HAPI FHIR contains multiple vulnerabilities. In the worst case, a user could read or write content in a tenant partition that they should not have access to, or an unauthenticated user could trigger a denial-of-service. 2. RECOMMENDED PRACTICES Update to most recent...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat-Embed-Core

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat-Embed-Core. Apache Tomcat-Embed-Core is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

K000163846: OpenJDK vulnerabilities CVE-2026-61308, CVE-2026-60589, CVE-2026-70906, and CVE-2026-70907

Security Advisory Description CVE-2026-61308 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2;...

EUVD-2026-107414

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass appMiddleware on dynamic and catch-all routes...

SUSE CVE-2026-98518

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

SUSE CVE-2026-98806

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized...

SUSE CVE-2026-98807

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

EUVD-2026-108229

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps...

SUSE CVE-2026-114636

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...

CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

EUVD-2026-107549

Sentry-Javascript: Middleware Bypass when using Tunnel route...

Access Control Bypass

Overview @sentry/nextjs is an Official Sentry SDK for Next.js Affected versions of this package are vulnerable to Access Control Bypass via the isPathnameUnderSentryTunnelRoute function in wrapMiddlewareWithSentry.ts when the tunnel route feature is enabled. The middleware wrapper incorrectly...

Security Bulletin: Security vulnerabilities have been found in IBM Guardium Discover and Classify (IGDC)

Summary Security Vulnerabilities have been addressed in IBM Guardium Discover and Classify IGDC Vulnerability Details CVEID:CVE-2026-19611 DESCRIPTION: A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters...

EUVD-2026-108218

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

CVE-2026-114486

The Devolutions Server (versions 2026.3.10.0 and earlier) is vulnerable to an incorrect authorization issue in the Devolutions Gateway token generation. An authenticated non-administrative attacker can bypass the Network Access Rules of a virtual gateway to reach denied hosts by utilizing wildcar...

Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in proxy-addr

Summary Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in proxy-addr. CVE-2026-90711 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client addre...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay

A flaw was found in OpenSSH's SSH daemon sshd. A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attack...