flatpak: flatpak: Arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

Security Bulletin:Vulnerability in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-68497)

Summary A security vulnerability has been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details...

Security Bulletin:Vulnerability in netty-codec-haproxy may affect IBM Infosphere Change Data Capture (CVE-2026-93564)

Summary A security vulnerability has been identified in netty-codec-haproxy, Netty/Codec/HAProxy. netty-codec-haproxy is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details...

Security Bulletin:Vulnerability in mariadb-java-client may affect IBM Infosphere Change Data Capture (CVE-2026-61700)

Summary A security vulnerability has been identified in mariadb-java-client, MariaDB Java Client. mariadb-java-client is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details...

Security Bulletin:Vulnerability in netty-codec-http may affect IBM Infosphere Change Data Capture (CVE-2026-89044)

Summary A security vulnerability has been identified in netty-codec-http, Netty codec module for encoding and decoding HTTP messages and handling HTTP protocol logic. netty-codec-http is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the...

Security Bulletin:Vulnerability in zstd-jni may affect IBM Infosphere Change Data Capture (CVE-2026-90852)

Summary A security vulnerability has been identified in zstd-jni, JNI bindings for Zstd native library. zstd-jni is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details...

Security Bulletin:Multiple vulnerabilities in jackson-core may affect IBM Infosphere Change Data Capture (CVE-2026-89407, CVE-2026-89425)

Summary Multiple security vulnerabilities have been identified in jackson-core, Core Jackson processing abstractions. jackson-core is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details...

Security Bulletin:Vulnerability in bcpkix-jdk18on may affect IBM Infosphere Change Data Capture (CVE-2026-17508)

Summary A security vulnerability has been identified in bcpkix-jdk18on, The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. bcpkix-jdk18on is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the...

Security Bulletin:Multiple vulnerabilities in zstd-jni may affect IBM Infosphere Change Data Capture (CVE-2026-89045, CVE-2026-89046, CVE-2026-90560)

Summary Multiple security vulnerabilities have been identified in zstd-jni, JNI bindings for Zstd native library. zstd-jni is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...

CVE-2026-72753

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory...

CVE-2026-102649

Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials configured for git...

Security Bulletin:Multiple vulnerabilities in postgresql may affect IBM Infosphere Change Data Capture (CVE-2026-107314, CVE-2026-107315)

Summary Multiple security vulnerabilities have been identified in postgresql, PostgreSQL JDBC Driver Postgresql. postgresql is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...

Security Bulletin:Multiple vulnerabilities in netty-codec-http may affect IBM Infosphere Change Data Capture (CVE-2026-93558, CVE-2026-93565, CVE-2026-93566, CVE-2026-93573)

Summary Multiple security vulnerabilities have been identified in netty-codec-http, Netty codec module for encoding and decoding HTTP messages and handling HTTP protocol logic. netty-codec-http is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the...

Security Bulletin:Multiple vulnerabilities in netty-handler-ssl-ocsp may affect IBM Infosphere Change Data Capture (CVE-2026-93493, CVE-2026-93578)

Summary Multiple security vulnerabilities have been identified in netty-handler-ssl-ocsp, Netty/Handler/Ssl/Ocsp. netty-handler-ssl-ocsp is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details...

CVE-2026-98902

A flaw was found in the Linux kernel's RAID5 storage driver. A sequence number comparison issue in stripe batch processing fails to account for 32-bit integer wrapping. During extensive storage write operations, the sequence counter may overflow, causing the system to misidentify newer stripe...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

CVE-2026-71455

Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive Data. This issue affects Kantech Entrapass: before 9.20...

CVE-2026-72753

The Routinator software contains a vulnerability related to how it handles RRDP notification files . When the software encounters a file with gaps in the delta entries , it incorrectly accepts and parses the data, which may result in missing data . Additionally, processing a file with an excessiv...

CVE-2026-72753 Routinator incorrectly handles delta updates

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory...

EUVD-2026-110026

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory...