PT-2026-71754

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

PT-2026-71698

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The Bluetooth host GATT client function parse read std char desc in subsys/bluetooth/host/gatt.c fails to validate the minimum value of the per-entry stride rsp-len received from a remote GATT server...

PT-2026-71773

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An internal data retrieval capability used by Elastic Defend endpoint response actions fails to enforce required Security Solution and endpoint privileges. This occurs because the system...

PT-2026-71776

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user capable of authoring and evaluating Elastic Security detection rules to execute Osquery and Elastic Defend response actions on managed hosts. This occurs...

PT-2026-71751

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass occurs due to a user-controlled key, allowing unauthorized cross-space access because functionality is not properly constrained by Access Control Lists ACLs. This issue...

PT-2026-71766

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with permissions to manage maintenance windows can cause a denial of service by submitting a specially crafted, malformed payload. This leads to excessive resource...

PT-2026-71749

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An issue exists where a query expression used in a connector reporting operation is processed without limits on its size. This allows an authenticated user with read-only privileges to send a...

CVE-2025-29923 affecting package telegraf for versions less than 1.31.0-27

CVE-2025-29923 affecting package telegraf for versions less than 1.31.0-27. A patched version of the package is available...

Security Bulletin: IBM i is Affected By An Improper Management Vulnerability in HTTP Server [CVE-2026-18071]

Summary IBM i is vulnerable to elevated privileges due to improper privilege management CVE-2026-18071 in HTTP Server as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18071 DESCRIPTION: IBM i could allow a local attacker to gain elevated privileges due to...

Security Bulletin: IBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM [CVE-2026-17078]

Summary IBM i is vulnerable to a denial of service due to resource exhaustion CVE-2026-17078 in Distributed Relational Database Architecture DRDA / Distributed Data Management DDM as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17078 DESCRIPTION: IBM i coul...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Multiple vulnerabilities are resolved: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518 Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

Security Bulletin: Insufficient Authentication Brute Force Protection on Login Endpoint

Summary A rate limiting capability exists within the product to restrict the number of authentication attempts permitted per IP address per minute against the login endpoint POST /api/v1/login. This control is configurable via the LANGFLOWRATELIMITENABLED environment variable, which defaults to...

GHSA-CRF3-V9RR-V7HJ vulnerabilities

Vulnerabilities for packages: seata...

Security Bulletin: IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP [CVE-2026-17438]

Summary IBM i is vulnerable to obtaining sensitive information or modifying data due to improper privilege management CVE-2026-17438 in Lightweight Directory Access Protocol LDAP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17438 DESCRIPTION: IBM i could...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-17029, CVE-2026-18511, CVE-2026-18068, CVE-2026-18086 in Java Secure Sockets Extension JSSE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17029 DESCRIPTION: IBM i could allow a local attacke...

Security Bulletin: IBM i is Affected By A Prvilege Escalation Vulnerability [CVE-2026-18509]

Summary IBM i is vulnerable to privilege escalation CVE-2026-18509 in Navigator and Debug Service as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18509 DESCRIPTION: IBM i could allow a local authenticated attacker to gain privilege escalation via the...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-16674, CVE-2026-18101, CVE-2026-18715 in WebSphere Application Server Liberty as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18101 DESCRIPTION: IBM i could allow a local attacker to gain...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol

Summary IBM i is vulnerable to multiple vulnerabilites CVE-2026-18077, CVE-2026-16815, CVE-2026-16692 in Simple Mail Transfer Protocol SMTP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18077 DESCRIPTION: IBM i could allow a remote attacker to cause a...

Security Bulletin: IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

Summary IBM i is vunlerable to multiple vulnerabilities CVE-2026-18193, CVE-2026-18249, CVE-2026-17476 in IBM SDK Java Technology Edition and IBM Runtime Environment Java to support the building and running of Java applications as described in the vulnerability details section. Vulnerability...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...