Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in IBM Semeru Runtime Quarterly CPU - Jul 2026 - Includes OpenJDK July 2026 CPU

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41254, CVE-2026-47057, CVE-2026-47063, CVE-2026-47058, CVE-2026-60147, CVE-2026-46968, CVE-2026-47027, CVE-2026-47021, CVE-2026-46917, CVE-2026-47059, CVE-2026-47010, CVE-2026-16439, CVE-2026-16441, CVE-2026-1624...

CVE-2026-54713

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-53579

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0 , the default-on Safe import filter sanitizes HTML only for text notes but excludes the book note type. Book note content is stored unsanitized and later injected into the page via jQuery's htm...

EUVD-2026-67224

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-68121 DESCRIPTION: During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses tomcat-embed-core-10.1.57, netty-codec-http2-4.2.15.Final.jar, mlflow-3.11.1-py3-none-any.whl, gitpython-3.1.49-py3-none-any.whl, docling-2.91.0-py3-none-any.whl, transformers-5.6.2-py3-none-any.whl, ip-address-10.2.0.tgz, bcutil-jdk18on-1.84.jar,...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses keras-3.14.1, bcprov-jdk18on-1.84.jar, sentencetransformers-5.2.0-py3-none-any.whl, pillow-12.2.0-cp311-cp311-manylinux227x8664.manylinux228x8664.whl, tomcat-embed-core-10.1.55.jar, langgraphsdk-0.3.13-py3-none-any.whl, and transformers-4.57.5-py3-none-any.whl which...

Duplicate Advisory: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8mpw-7fpc-4gqj. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows...

GHSA-3M7F-6HXV-6796 Duplicate Advisory: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8mpw-7fpc-4gqj. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.323 Vulnerability Details CVEID:CVE-2026-48776 DESCRIPTION: LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python...

PYSEC-2026-3752

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

PYSEC-2026-3752

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

DEBIAN-CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

Inefficient Algorithmic Complexity

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readblock method of TEICorpusView nltk/corpus/reader/pl196x.py, whose lazy .? whole-block regexes...

UBUNTU-CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...