OESA-2026-4635 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced...

OESA-2026-4533 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: A missing critical step in...

OESA-2026-4534 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: A missing critical step in...

OESA-2026-4532 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: A missing critical step in...

OESA-2026-4531 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: A missing critical step in...

CVE-2026-85498

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

EUVD-2026-112679

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

BIT-TOMCAT-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0 through 11.0.26,...

BIT-RCLONE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

BIT-NODE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity did not classify these hosts as IP...

BIT-OPENBAO-2026-115362 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

Security update for rust-keylime

This update for rust-keylime fixes the following issue: CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc1287921...

SUSE-SU-2026:4931-1 Security update for rust-keylime

This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc128792...

Security update for rust-keylime

This update for rust-keylime fixes the following issue: CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc1287921...

SUSE-SU-2026:4930-1 Security update for rust-keylime

This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc128792...

SUSE-SU-2026:4927-1 Security update for libapr1, libtcnative-1-0, tomcat

This update for libapr1, libtcnative-1-0, tomcat fixes the following issues: - CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore bsc1282631. - CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure bsc1286502. - CVE-2026-7404...

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift , is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco...

Waline Login Accepts A Non-string Email As A Match-all MongoDB Query

Summary The login endpoint POST /api/token reads the "email" field from the request body without checking its type and passes it straight into the MongoDB storage query. When "email" is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently...

Strengthening API and MCP Security Through Token Risk Detection with Thales Imperva API Security

Security teams can now investigate six token risks directly at the endpoint level, making it easier to prioritize findings and take action across their API estate. APIs depend on tokens to authenticate requests and control access. But weak signing algorithms, excessive token lifetimes, exposed...

CVE-2026-117859

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...