CVE-2025-32781 Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...

SUSE-SU-2026:3037-1 Security update for yelp

This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625...

Security update for yelp

This update for yelp fixes the following issue CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for yelp

This update for yelp fixes the following issue CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

The vulnerability of the libcurl library in software applications for interacting with servers via cURL allows a hacker to gain unauthorized access to protected information.

The vulnerability of the libcurl library in software applications for interacting with servers via cURL is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection in the writeData process. An attacker can achieve code execution on an administrator's workstation by planting specially crafted payloads in text fields, which are then exported to CSV and executed when opened in spreadshe...

CVE-2026-44771

Technical details about CVE-2026-44771 are not publicly available in the provided documents; monitor for updates as new information may be released.

The vulnerability of the MQTT 5 framework for developing network applications, servers, and clients using Netty protocol allows a hacker to cause a service failure.

The vulnerability of the MQTT 5 framework for developing network applications, servers, and client protocols related to Netty involves an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

[SECURITY] Fedora 43 Update: docker-compose-5.3.0-1.fc43

Define and run multi-container applications with Docker...

OPENSUSE-SU-2026:21295-1 Security update for yelp

This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625...

CVE-2026-45409

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

erb: ERB: Arbitrary code execution via deserialization bypass

A flaw was found in ERB, a templating system for Ruby. An attacker who can trigger deserialization of untrusted data in a Ruby application can bypass existing protections. This vulnerability allows for arbitrary code execution by exploiting specific public methods that evaluate template source...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by multiple vulnerabilities (CVE-2026-50645, CVE-2026-9322, CVE-2026-9171)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by uncontrolled resource consumption and denial of service. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by a Denial of Service vulnerability due to pyasn1

Summary pyasn1 is used by IBM Cloud Pak for Data System 1.0 as a generic ASN.1 encoding and decoding library for Python applications. CVE-2026-30922 affects pyasn1's ASN.1 decoder, where processing of crafted payloads containing deeply nested SEQUENCE or SET tags with indefinite length markers...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an authorization bypass vulnerability (CVE-2026-11714)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an authorization bypass vulnerability with the apiDiscovery-1.0 feature enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Sentry vulnerable to incorrect credential validation on OAuth token requests

ImpactAn attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account...

PYSEC-2026-1915 Sentry vulnerable to incorrect credential validation on OAuth token requests

Impact An attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1,...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by multiple cross-site scripting vulnerabilities (CVE-2026-11594, CVE-2026-11707, CVE-2026-11383)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by multiple cross-site scripting vulnerabilities in the administrative console. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Produc...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the CreateSubAgent process. An attacker can gain unauthorized access to workspace applications by registering sub-agent apps with a sharing level that exceeds the administrator's configured maximum, thereby...