Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CVE-2026-84695 BookStack before 26.05.4 Stored XSS via Drawing Upload

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

DEBIAN-CVE-2026-81928

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplaced TSIG record. sigdata signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or...

PT-2026-84574

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

MAL-2026-15814 Malicious code in chromatitle-dev (npm)

The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...

RHEL 10 : go-fdo-server (RHSA-2026:62578)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62578 advisory. This package provides a server-side implementation of the FIDO Device Onboard FDO specification, written in Go. FDO is an open standard fo...

The vulnerability of the /admin/adminHome.php file on the web platform used for displaying and selling art works in the Online Art Gallery Shop Project allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the /admin/adminHome.php file on the web platform used for displaying and selling art works in the Online Art Gallery Shop Project is related to incorrect elimination of special elements in the output data. Exploitation of this vulnerability could allow an attacker, operating...

PT-2026-84846

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.11.0 Description The Request. prepare function in src/httpx2/httpx2/ models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. This occurs...

CVE-2026-84380: Inconsistent Interpretation of HTTP Requests

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84655: Improper Encoding or Escaping of Output

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

Malicious code in chromatitle-dev (npm)

The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...

The vulnerability of the http.cookies.Morsel.jsOutput() method in the Python programming language interpreter (CPython) allows a hacker to execute arbitrary code. [source-iocs-preserved method=http.cookies.Morsel.js_output()]

The vulnerability of the http.cookies.Morsel.jsOutput method in the Python programming language interpreter CPython is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a remote attacker to exploit the system. source-iocs-preserved...

CVE-2026-84292: Improper Encoding or Escaping of Output

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

Improper Encoding or Escaping of Output

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Improper Encodin...

EEF-CVE-2026-69664 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Summary Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection i...

EUVD-2026-69381

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...

CVE-2026-69664 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...

CVE-2026-69664

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...

CVE-2026-73812

Erlang/OTP inets (HTTP server module) is vulnerable to HTTP Request Smuggling (CL.TE desync) when deployed behind a Content-Length-preferring front-end proxy. The root cause is in httpd:check_header/3 , which rejects duplicate Content-Length headers but never validates the simultaneous presence o...

EUVD-2026-69235

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...