Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip through 2.0.1 only checks the parent directory of each archive entry, allowing a symlink-then-regular-file pair with identical names to write through the planted symlink and achieve arbitrary file write outside the destination directory. CVSS: 8.1 High, CWE-22. Vulnerability...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip 2.0.1 does not validate symlink targets during zip extraction, allowing a malicious archive with relative symlink paths to read or write arbitrary files outside the extraction directory. CVSS: 8.1 High, CWE-22. Vulnerability Details CVEID:CVE-2026-56876 DESCRIPTION: extract-zi...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.9.9 release.

Red Hat Developer Hub 1.9.9 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

Did an AI really try to break free from human control?

Amid discussions about slowing down AI development, the Telegraph ran the headline: “OpenAI sounds alarm after bot tries to break free from human control.” That headline is slightly misleading, in my opinion. The Telegraph headline overstates what happened, although the underlying behavior is sti...

Security Bulletin: DEV-EXT - spring-webmvc-6.2.19.jar (Publicly disclosed vulnerability found by Scanner)

Summary IBM Db2 Developer Extension is affected by 3 Spring MVC CVEs in spring-webmvc-6.2.19.jar: CVE-2026-47884 — CVSS 9.8 , CVE-2026-47887 — CVSS 6.1 , CVE-2026-47890 — CVSS 9.8 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSR...

Security Bulletin: nanoid-3.3.18.tgz (Publicly disclosed vulnerability found by Scanner)

Summary nanoid before 5.1.6/5.1.16 has infinite loops in customAlphabet/customRandom/nanoid non-secure when passed a size of 0 or negative value, hanging the calling thread and causing DoS. CVSS: 5.9 Medium, CWE-835. Vulnerability Details CVEID:CVE-2026-67213 DESCRIPTION: nanoid Nano ID before...

Security Bulletin: dompurify-3.4.12.tgz (Publicly disclosed vulnerability found by Scanner)

Summary DOMPurify before 3.4.13 has an XSS vulnerability in INPLACE sanitization — element-removal hooks fail to neutralize detached subtrees, allowing event handlers on descendant elements to execute after sanitization completes. CVSS: 5.1 Medium, CWE-79. Vulnerability Details...

Security Bulletin: jackson-databind-2.21.2.jar

Summary IBM Db2 Developer Extension uses jackson-databind, which is vulnerable to multiple security issues including polymorphic type validator bypass CVE-2026-54512, CVE-2026-54513, server-side request forgery via DNS resolution CVE-2026-54514, improper @JsonIgnore enforcement CVE-2026-54515,...

Security Bulletin: IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core (CVE-2026-41848)

Summary IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core CVE-2026-41848 Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which i...

Security Bulletin: Vulnerability in @opentelemetry/core affects DB2 Dev Extension (CVE-2026-54285)

Summary Upgraded @opentelemetry/core to 2.8.0. Vulnerability Details CVEID:CVE-2026-54285 DESCRIPTION: opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP header...

Security Bulletin: Vulnerability in Apache Log4j API affects DB2 Dev Extension (CVE-2026-49844)

Summary Upgraded log4j-api to 2.25.5 to remediate CVE-2026-49844 CWE-116: Improper Encoding of non-finite floating-point values in MapMessage JSON serialization — CVSS Base Score 6.3 Medium — PVR0815934. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: brace-expansion-2.1.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary brace-expansion 2.1.1 affected by CVE-2026-13149 — exponential CPU consumption in expand via consecutive non-expanding brace groups, causing event-loop blocking DoS. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service...

Security Bulletin: Vulnerability in Spring Boot affects DB2 Dev Extension (CVE-2026-40992, CVE-2026-41001)

Summary Upgraded spring-boot-autoconfigure to 3.5.15 to remediate CVE-2026-40992 Improper Certificate Validation and CVE-2026-41001 Insecure Temporary File — highest CVSS Base Score 5.3 Medium — PVR0789890. Vulnerability Details CVEID:CVE-2026-40992 DESCRIPTION: Spring Boot's Mail...

Security Bulletin: Vulnerability in brace-expansion affects DB2 Dev Extension (CVE-2026-14257)

Summary Upgraded brace-expansion to 5.0.8 to remediate CVE-2026-14257 CWE-400: Uncontrolled Resource Consumption — memory exhaustion DoS via unbounded result string length in expand — CVSS Base Score 7.5 High — PVR0827522. Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion...

Security Bulletin: Vulnerability in form-data affects DB2 Dev Extension (CVE-2026-12143)

Summary Upgraded form-data to 4.0.6 to remediate CVE-2026-12143 CWE-93: CRLF Injection — CVSS Base Score 7.5 High — PVR0791412. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in Spring Expression (CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 )

Summary IBM Db2 Developer Extension is affected by vulnerability in Spring Expression CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

Security Bulletin: Vulnerability in Apache Tomcat affects DB2 Dev Extension (CVE-2026-59083, CVE-2026-59084)

Summary Upgraded tomcat-embed-core to 10.1.57 to remediate CVE-2026-59083 Security Constraint Bypass via URL hex-encoding and CVE-2026-59084 Insufficient EncryptInterceptor Documentation — CVSS Base Score 9.1 Critical — PVR0818163. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper...

CVE-2026-92784

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515 Vulnerability Details CVEID:CVE-2026-41293 DESCRIPTION: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat:...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in log4j core (CVE-2026-34477, CVE-2026-34478)

Summary IBM Db2 Developer Extension is affected by vulnerability in log4j core CVE-2026-34477, CVE-2026-34478 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificatio...