PT-2026-135596

TuxCare rebuilt @babel/compat-data to address 1 CVE. Fixed in 7.14.8-tuxcare.2...

PT-2026-135594

TuxCare rebuilt @babel/compat-data to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-135593

TuxCare rebuilt @babel/compat-data to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

PT-2026-135590

TuxCare rebuilt @babel/compat-data to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-135579

TuxCare rebuilt @babel/compat-data to address 1 CVE. Fixed in 7.24.1-tuxcare.2...

PT-2026-135587

TuxCare rebuilt @babel/compat-data to address 1 CVE. Fixed in 7.23.2-tuxcare.2...

PT-2026-135589

TuxCare rebuilt @babel/compat-data to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

PT-2026-121974

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu userq get doorbell index pins any BO passed as doorbell handle into the doorbell domain. For a regular BO, TTM moves it with ttm bo move null and its contents ar...

Cisco Expressway micro-programming software Data Compromise

The vulnerability of Cisco Expressway microprogramming software is related to improper code generation management. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

SUSE CVE-2026-98583

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

Malicious code in react-native-bright-sdk (npm)

react-native-bright-sdk 9000.0.0 is a dependency-confusion package that squats the name of a React Native SDK that is distributed privately as a tarball outside the npm registry. Its preinstall script runs node canary.js, which collects the machine's hostname and a timestamp, base64-encodes them...

Exposure of Data Element to Wrong Session

Overview strands-agents is an A model-driven approach to building AI agents in just a few lines of code Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the A2A server component multiagent.a2a module, which does not properly isolate conversation...

Exposure of Data Element to Wrong Session

Overview @strands-agents/sdk is a TypeScript SDK for Strands Agents framework Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the A2A server component multiagent.a2a module, which does not properly isolate conversation state between callers. An...

CVE-2026-111181

A flaw was found in body-parser. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a specially crafted HTTP request with compressed content containing unexpected trailing data. Because the application fails to handle decompression stream errors after processing the...

CVE-2026-101720

A flaw was found in MySQL connection handling. An unauthenticated remote attacker with network access can exploit this vulnerability to compromise the database server. Successful exploitation allows an attacker to perform unauthorized data modifications, resulting in the creation, alteration, or...

CVE-2026-101785

A flaw was found in the MySQL Server JSON component. An authenticated remote attacker with low privileges can exploit this vulnerability over network protocols to modify, create, or delete accessible database records. Successful exploitation can also result in a Denial of Service DoS by crashing ...

CVE-2026-101775

A flaw was found in the MySQL Server replication component. An unauthenticated remote attacker with network access could exploit this vulnerability to create, delete, or modify critical database data. A successful attack can also lead to a Denial of Service DoS by causing the server to hang or...

CVE-2026-101637

A flaw was found in MySQL's InnoDB component. A high-privileged remote attacker with network access can exploit this vulnerability to cause the server to hang or crash repeatedly, resulting in a Denial of Service DoS. Additionally, exploitation can allow unauthorized data modification, enabling t...

CVE-2026-98723

A flaw was found in the Linux kernel's NVMe target nvmet subsystem. An uninitialized host identifier in persistent reservation references prevents the target from aborting and draining in-flight input/output I/O requests during a Preempt and Abort operation. A connected NVMe host can trigger this...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in libcurl (CVE-2026-8458, CVE-2026-8927)

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in libcurl, including Exposure of Data Element to Wrong Session and Authentication Bypass by Capture-replay. Libcurl is used in our Speech Service Runtimes. These vulnerabilities have been addressed. Please read the...