Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-0994 DESCRIPTION: A...

CVE-2026-53128: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drbd: Balance RCU calls in drbdadmdumpdevices Make drbdadmdumpdevices call rcureadlock before rcureadunlock is called. This has been detected by the Clang thread-safety analyzer...

HPESBNW05073 rev.1 - HPE Telco Unified Correlation and Automation (UCA), Multiple Vulnerabilities

Potential Security Impact: Local: Input Validation; Remote: Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified Correlation Analyzer UCA Older than 4.4.10 - Fixed in version UCA 4.4.10 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter

SurrealDB's full-text search lets you define a text analyzer whose mapper filter loads a term-mapping file from disk DEFINE ANALYZER ... FILTERS mapper''. A database user with the EDITOR or OWNER role could point that filter at any file the SurrealDB process can read and have its content returned...

cybersecurity-log-analyzer

No d...

ai-security-analyzer (>=0.0.45, <=0.0.55), browser-use (>=0.2.6, <=0.3.2) +3 more potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.15)

langchain-anthropic PYPI version 0.3.15 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - ai-security-analyzer =0.0.45, =0.2.6, =0.8.0, =0.4.1, =0.5.4 - re-browser-use 0.3.2 Source cves: CVE-2026-55443 Source...

org.jenkins-ci.main:jenkins-test-harness (1.594), org.jenkins-ci.main:jenkins-war (1.594) +2 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.594)

org.jenkins-ci.main:jenkins-core MAVEN version 1.594 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.594 - org.jenkins-ci.main:jenkins-war 1.594 -...

org.jenkins-ci.main:jenkins-test-harness (1.594), org.jenkins-ci.main:jenkins-war (1.594) +2 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.594)

org.jenkins-ci.main:jenkins-core MAVEN version 1.594 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.594 - org.jenkins-ci.main:jenkins-war 1.594 -...

org.jenkins-ci.main:jenkins-test-harness (1.594), org.jenkins-ci.main:jenkins-war (1.594) +2 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.594)

org.jenkins-ci.main:jenkins-core MAVEN version 1.594 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.594 - org.jenkins-ci.main:jenkins-war 1.594 -...

org.jenkins-ci.main:jenkins-test-harness (1.594), org.jenkins-ci.main:jenkins-war (1.594) +2 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.594)

org.jenkins-ci.main:jenkins-core MAVEN version 1.594 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.594 - org.jenkins-ci.main:jenkins-war 1.594 -...

org.jenkins-ci.main:jenkins-test-harness (1.594), org.jenkins-ci.main:jenkins-war (1.594) +2 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.594)

org.jenkins-ci.main:jenkins-core MAVEN version 1.594 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.594 - org.jenkins-ci.main:jenkins-war 1.594 -...

org.jenkins-ci.main:jenkins-test-harness (1.594), org.jenkins-ci.main:jenkins-war (1.594) +2 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.594)

org.jenkins-ci.main:jenkins-core MAVEN version 1.594 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.594 - org.jenkins-ci.main:jenkins-war 1.594 -...

org.jenkins-ci.main:jenkins-test-harness (1.594), org.jenkins-ci.main:jenkins-war (1.594) +2 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (1.594)

org.jenkins-ci.main:jenkins-core MAVEN version 1.594 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.594 - org.jenkins-ci.main:jenkins-war 1.594 -...

CVE-2026-22828

A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Successful exploitation would require a large...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

dpckan (0.0.1.9000), pysqream-log-analyzer (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-8643 via pip (21.1.2)

pip PYPI version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - dpckan 0.0.1.9000 - pysqream-log-analyzer =0.0.1, =0.1.8, =0.1.10 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

dpckan (0.0.1.9000), pysqream-log-analyzer (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-8643 via pip (21.1.2)

pip PYPI version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - dpckan 0.0.1.9000 - pysqream-log-analyzer =0.0.1, =0.1.8, =0.1.10 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

CVE-2026-45555 Roslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code Execution

Roslyn CodeLens MCP Server is a Roslyn-based MCP server providing semantic code intelligence for .NET codebases. From 0.0.9 to 1.17.0, the getdiagnostics MCP tool loads and executes all DiagnosticAnalyzer assemblies referenced by the target solution without any allowlist, signature check, or user...

Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer and Hitachi Ops Center Analyzer viewpoint

Overview Vulnerability has been found in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer and Hitachi Ops Center Analyzer viewpoint. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' sectio...

Packetbeat Array Indexing

The vulnerability of the Network Packetbeat analyzer is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker operating remotely to compromise the confidentiality, integrity, and accessibility of the protected information...