Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary IBM Java is used by IBM Sterling Connect:Direct Web Services CVE-2026-34282, CVE-2026-22016, CVE-2026-23865, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-22008, CVE-2026-34268, CVE-2026-22007, CVE-2026-6918. Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1550 more potentially affected by CVE-2026-5038 via multer (>=2.0.0, <=2.1.1)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-5038 Source advisory: SNYK:JS-MULTER-17342516...

NPM: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

NPM: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases vulnerability discovered by ? in WordPress Npm js-yaml versions = 4.1.1...

003-gas-convert (1.0.1), 0x-hunter-core (>=1.0.0-3, <=1.0.1-5) +28840 more potentially affected by CVE-2026-48779 via ws (>=1.1.0, <=5.2.2)

ws NPM version =1.1.0, =1.0.0-3, =0.0.3, =1.1.0, =0.9.9, =1.0.0, =0.0.1, =0.11.3, =0.1.0, =1.0.2, =1.0.7 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

0.edsql (>=1.0.49, <=1.0.50), 0x-v4-nft (1.1.0) +8944 more potentially affected by CVE-2026-48779 via ws (>=7.0.0, <=7.5.10)

ws NPM version =7.0.0, =1.0.49, =0.0.11, =0.0.2, =1.0.0, =0.1.0, =0.0.12, =0.0.12, =0.1.0, =1.0.22, =3.10.1, =3.11.0 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +33756 more potentially affected by CVE-2026-48779 via ws (>=8.0.0, <=8.20.1)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit 0.1.0 - 0g-zksettlement-client 1.0.0 - 0wcc9yywcywy 1.0.0 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

7ghost (>=4.11.25, <=4.11.46), @100mslive/hms-excalidraw (>=0.1.3, <=0.1.14) +1258 more potentially affected by CVE-2026-48779 via ws (>=6.0.0, <=6.2.3)

ws NPM version =6.0.0, =4.11.25, =0.1.3, =0.0.1-bate.30, =0.0.1, =0.0.1, =7.0.0-rc1, =0.1.0, =4.4.0-rc.1, =4.2.2, =2.9.0, =0.0.1-alpha.95, =1.0.0-alpha.46, =1.2.0, =1.6.2 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

0.edsql (>=1.0.49, <=1.0.50), 0x-v4-nft (1.1.0) +8944 more potentially affected by CVE-2026-48779 via ws (>=7.0.0, <=7.5.10)

ws NPM version =7.0.0, =1.0.49, =0.0.11, =0.0.2, =1.0.0, =0.1.0, =0.0.12, =0.0.12, =0.1.0, =1.0.22, =3.10.1, =3.11.0 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

7ghost (>=4.11.25, <=4.11.46), @100mslive/hms-excalidraw (>=0.1.3, <=0.1.14) +1258 more potentially affected by CVE-2026-48779 via ws (>=6.0.0, <=6.2.3)

ws NPM version =6.0.0, =4.11.25, =0.1.3, =0.0.1-bate.30, =0.0.1, =0.0.1, =7.0.0-rc1, =0.1.0, =4.4.0-rc.1, =4.2.2, =2.9.0, =0.0.1-alpha.95, =1.0.0-alpha.46, =1.2.0, =1.6.2 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

mysql: InnoDB unspecified vulnerability (CPU Apr 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via...

PT-2026-49583

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 Description A Denial of Service DoS issue exists in the @angular/common package. The formatDate function, also used by the standard DatePipe,...

CVE-2025-55660

A stack overflow in the gfopusreadlength function mediatools/avparsers.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

RHEL 9 : osbuild-composer (RHSA-2026:26054)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:26054 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

CVE-2025-55652

A heap buffer overflow in the gfisomvpconfignew function isomedia/avcext.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-55648

A heap buffer overflow in the gfopusparsepacketheader function mediatools/avparsers.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-55643

A NULL pointer dereference in the TrackWriter handling component filters/muxisom.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Linux Distros Unpatched Vulnerability : CVE-2026-46384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker- controlled 64-bit values from the wire format and either...

PT-2026-49233

Name of the Vulnerable Software and Affected Versions multer versions 1.0.0 through 2.1.1 multer version 3.0.0-alpha.1 Description A Denial of Service issue exists due to the way the append-field dependency parses bracket notation in field names within multipart form data. Because there is no lim...

CVE-2025-55641

A NULL pointer dereference in the gfisomcopysampleinfo function isomedia/isomwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-49330

Name of the Vulnerable Software and Affected Versions LLDAP version 0.6.2 Description An input handling flaw in the HTTP refresh token process allows attackers to cause a Denial of Service DoS, which is a condition where a service becomes unavailable to its intended users, by sending a crafted...