Security Bulletin: Multiple security vulnerabilities in RedHat UBI affect IBM Robotic Process Automation for Cloud Pak

Summary Multiple vulnerabilities in RedHat UBI affect IBM Robotic Process Automation for Cloud Pak. RedHat UBI is used as base image for IBM Robotic Process Automation for Cloud Pak images. This bulletin identifies the fixes required to address the vulnerabilites. Vulnerability Details...

OESA-2026-1083 assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose. Security Fixes: A weakness has been identified in Op...

EUVD-2026-3085

Malicious code in base-ui-vue3 npm...

MAL-2026-270 Malicious code in base-ui-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02dfd5d7f28a3a6c1911e9b745f0114967cd677bea80bbfc7c490e6bf1f09ddf The package base-ui-vue3 was found to contain malicious code. Source: ghsa-malware 88f9d0f6ba47ed2a8d641427839b31d3b2debfea9d13f32125734f392a0838d9 A...

Malicious code in base-ui-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02dfd5d7f28a3a6c1911e9b745f0114967cd677bea80bbfc7c490e6bf1f09ddf The package base-ui-vue3 was found to contain malicious code. Source: ghsa-malware 88f9d0f6ba47ed2a8d641427839b31d3b2debfea9d13f32125734f392a0838d9 A...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000618)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000618 advisory. arch/x86/kernel/entry64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment SS segment register, which allows local...

MiracleLinux 4 : 389-ds-base-1.2.11.15-20.AXS4 (AXSA:2013-585:04)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-585:04 advisory. 389 Directory Server is an LDAPv3 compliant server. The base package includes the LDAP server and command line utilities for server administration. Security...

MiracleLinux 7 : resteasy-base-3.0.6-4.el7 (AXSA:2016-1120:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-1120:01 advisory. RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and...

MiracleLinux 4 : 389-ds-base-1.2.11.15-94.AXS4 (AXSA:2018-2619:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2619:01 advisory. 389-ds-base: remote Denial of Service DoS via search filters in SetUnicodeStringFromUTF8 in collate.c CVE-2018-1054 389-ds-base: Authentication bypa...

MiracleLinux 4 : net-snmp-5.5-49.AXS4.1.0.1 (AXSA:2014-203:02)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-203:02 advisory. SNMP Simple Network Management Protocol is a protocol used for network management. The NET-SNMP project includes various SNMP tools: an extensible agent, an...

MiracleLinux 7 : 389-ds-base-1.3.8.4-15.el7 (AXSA:2018-3383:09)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3383:09 advisory. 389-ds-base: Mishandled search requests in servers/slapd/search.c:dosearch allows for denial of service CVE-2018-14648 Tenable has extracted the preceding...

MiracleLinux 7 : GStreamer (AXSA:2017-2179:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2179:01 advisory. clutter-gst2 Clutter is an open source software library for creating fast, visually rich and animated graphical user interfaces. Clutter GStreamer...

MiracleLinux 7 : 389-ds-base-1.3.8.4-25.1.el7 (AXSA:2019-3946:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-3946:02 advisory. 389-ds-base: DoS via hanging secured connections CVE-2019-3883 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 7 : 389-ds-base-1.3.6.1-28.el7 (AXSA:2018-2594:02)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2594:02 advisory. 389-ds-base: remote Denial of Service DoS via search filters in SetUnicodeStringFromUTF8 in collate.c CVE-2018-1054 389-ds-base: Authentication bypa...

MiracleLinux 4 : 389-ds-base-1.2.11.15-22.AXS4 (AXSA:2013-595:05)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-595:05 advisory. Directory Server is an LDAPv3 compliant server. The base package includes the LDAP server and command line utilities for server administration. Security issue...

Asymmetric Resource Consumption (Amplification)

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification due to the improper validation in ArrayBuffer if input...

CVE-2026-22775 devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse inpu...

CVE-2025-64516

GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item ticket, asset, .... If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed i...

CVE-2021-47776

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and...

Moderate: Red Hat Security Advisory: Red Hat Update Infrastructure 5 security update

The latest release of Red Hat Update Infrastructure. For more details, see the product documentation. Red Hat Update Infrastructure RHUI container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version...