Security Bulletin: IBM Storage Protect Server is susceptible to vulnerabilities due to Golang library related to ObjectAgent(CVE-2026-39824).

Summary Golang library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang is affected by multiple vulnerabilities that may cause data integrity issues, or memory handling problems when processing specially crafted input. This bulletin identifies the steps to address...

Security Bulletin:IBM Storage Protect Server is affected by a vulnerability in the Apache POI library that could lead to denial-of-service when processing specially crafted archive files (CVE-2019-12415).

Summary IBM Storage Protect Server uses the Apache POI library in certain components; this library is vulnerable to processing specially crafted archive files that may cause excessive memory allocation, potentially leading to a denial-of-service condition. Vulnerability Details CVEID:CVE-2019-124...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow inadequate validation and processing of maliciously crafted input. (CVE-2026-4410, CWE-400)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow inadequate validation and processing of maliciously crafted input during request handling operations, that could impact the security of the...

CVE-2026-55824 Contao crawler leaks auth credentials to external hosts

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

@10xsai/cloudflare-router-nx-plugin (1.0.0), @abelfubu/schematics (0.1.1) +694 more potentially affected by CVE-2026-54753 via nx (>=17.0.4, <=22.7.1)

nx NPM version =17.0.4, =2.2.1, =0.0.1, =0.1.5, =0.0.3, =0.0.4, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =1.0.1 - @aloes/nx-heroku 0.4.1 - @altariotechnologieslisbon/query-resolver 0.14.2 and more Source cves: CVE-2026-54753 Source advisory: OSV:GHSA-G2R8-WVMJ-JF5W...

GHSA-G2R8-WVMJ-JF5W `nx graph` dev server permissive CORS policy

Summary The local HTTP server started by nx graph sent Access-Control-Allow-Origin: on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help...

CVE-2026-10686 Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6routepacket subsys/net/ip were affected: the explicit-route path netroutepacket and the on-link cross-interface path netroutepacketif. Each set the packet...

CVE-2026-10686

Zephyr IPv6 forwarding path has a bug where hop-limit is not decremented in both ipv6_route_packet() branches (explicit-route net_route_packet() and on-link net_route_packet_if()). This causes routed unicast packets to be forwarded indefinitely, enabling a potential on-path attacker to induce a p...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-15227

Summary: CVE-2026-15227 affects Checkmk prior to versions 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 (EOL). An authenticated user who lacks the "Edit foreign Reports" permission can modify reports owned by other users due to missing authorization. What’s affected: Checkmk installations running the l...

EUVD-2025-210567

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...

CVE-2025-67650

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-62391

Apache Kyuubi versions 1.6.0 before 1.12.0 are vulnerable to Directory Traversal due to incomplete fixes for CVE-2025-66518. An attacker can bypass the kyuubi.session.local.dir.allowlist configuration by submitting Spark frontend requests that use unprefixed Spark config aliases (such as files) i...

SUSE CVE-2025-7453

A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/internal/app/service/token.go of the component JSON Web Token Handler. The manipulation with the input 123 leads to use of hard-coded...

SUSE CVE-2026-3590

Mattermost versions 10.11.x = 10.11.12, 11.5.x = 11.5.0, 11.4.x = 11.4.2, 11.3.x = 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent...

SUSE CVE-2026-3636

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data about team members roles via invoking various team API...

SUSE CVE-2026-4635

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to archive the channel before removing persistent notifications which allows authenticated user to crash the server via timing the creation of persistent notification message between the server deleting...

SUSE CVE-2026-6333

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost...