Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 1.0 - NRS have been addressed in version 3.0.5.4 Vulnerability Details CVEID:CVE-2026-62574 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Ja...

Security update for docker-stable

This update for docker-stable fixes the following issues: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

SUSE-SU-2026:4535-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

Security update for docker-stable

This update for docker-stable fixes the following issues: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

SUSE-SU-2026:4533-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

CVE-2026-105315

A flaw was found in django-haystack. This flaw allows a remote attacker to achieve arbitrary code execution on the hosting server by supplying crafted data to the search index. Due to improper input handling, the Elasticsearch backend unsafely evaluates raw search result values as executable code...

USN-8873-1: Unbound vulnerabilities

Yuqi Qiu and Xiang Li discovered that Unbound did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-81642 Ben Morris discovered that Unbound did not correctly handle certain memory operations...

USN-8873-1 unbound vulnerabilities

Yuqi Qiu and Xiang Li discovered that Unbound did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-81642 Ben Morris discovered that Unbound did not correctly handle certain memory operations...

Malicious code in hardhat-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb The npm package hardhat-init presents itself as Hardhat initialization tooling and ships a README, LICENSE, and index.d.ts copied from the pino logge...

MAL-2026-17636 Malicious code in hardhat-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb The npm package hardhat-init presents itself as Hardhat initialization tooling and ships a README, LICENSE, and index.d.ts copied from the pino logge...

Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS

IBM SECURITY ADVISORY First Issued: Tue Oct 6 01:00:55 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/postgresadvisory2.asc Security Bulletin: Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS...

EUVD-2026-92811

In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This...

CVE-2026-105745

A flaw was found in Docling. Docling imports registered plugin entry points before evaluating whether external plugins are permitted. A local attacker or compromised package installed in the environment can exploit this flaw to achieve arbitrary code execution during startup, even when external...

CVE-2026-106234: Use After Free

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: Low...

PT-2026-107101

Name of the Vulnerable Software and Affected Versions hydra-optuna-sweeper versions 1.2.0 through 1.3.0 hydra-optuna-sweeper versions 1.4.0.dev1 through 1.4.0.dev9 Description The hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom search space, whi...

PT-2026-106951

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Select component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

Security Advisory 0193

Security Advisory 0193 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-102162 CVSSv3.1 Base Score: 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSSv4.0 Base Score: 9.4...

A memory buffer overflow vulnerability exists in an internal diagnostic routine of Brocade Fabric OS (CVE-2026-94582)

: A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First FSPF protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directl...