JLSEC-2026-1338

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool.When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificat...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Improper Serialization due to Apache Log4j JSON Template Layout

Summary Apache Log4j JSON Template Layout in Apache Solr is used by IBM Operations Analytics - Log Analysis as part of the encoding log events. CVE-2026-34481. Vulnerability Details CVEID:CVE-2026-34481 DESCRIPTION: Apache Log4j's JsonTemplateLayout...

Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access

Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker. The advisory, published August 17, 2026, is the second stage of ...

Security Bulletin: Multiple vulnerabilities in third-party Netty libraries affect the IBM Informix Wire Listener.

Summary Multiple vulnerabilities in Netty affect the IBM Informix Wire Listener. IBM Informix has addressed these vulnerabilities by updating the Netty components to their latest versions. Vulnerability Details CVEID:CVE-2026-33871 DESCRIPTION: Netty is an asynchronous, event-driven network...

Improper file access permission settings in Synology Assistant

Overview Synology Assistant provided by Synology Inc. contains the following vulnerability. Incorrect default permissions CWE-276 - CVE-2026-4793 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

MINI-G8CW-CJ39-228V

Bulletin has no description...

MINI-W7GW-V54C-QV9P

Bulletin has no description...

MINI-7GG7-C6MW-PVV4

Bulletin has no description...

MINI-RWCG-XPCG-CPHW

Bulletin has no description...

MINI-JP69-PRW3-Q5JQ

Bulletin has no description...

MINI-5HH7-GH6W-8RF9

Bulletin has no description...

MINI-2V6R-GM7X-XCQ5

Bulletin has no description...

MINI-FV6M-X7PX-MH3V

Bulletin has no description...

MINI-56CM-G5MF-QJVG

Bulletin has no description...

MINI-QGMM-HJC9-VMWX

Bulletin has no description...

MINI-28X3-W7QW-C3CW

Bulletin has no description...

BIT-LIBPHP-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

BIT-AIRFLOW-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

Exploit for CVE-2026-74251

Unauthenticated SQL Injection via Attribute Filter in Phoca Ca...

CVE-2026-19974 treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be...