Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-8384 DESCRIPTION: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: afunix: Do not use GC if MSGPEEK occurred. Igor Ushakov reported that GC purged the receive queue of a live socket due to a race with MSGPEEK, with a fix provided. This is exactly the same issue that was previously fixed in the...

CVE-2026-14950

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

CVE-2026-14951

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14952

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

EUVD-2026-63223

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

EUVD-2026-63222

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

EUVD-2026-63221

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

CVE-2026-14951: Cross-Site Request Forgery (CSRF)

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14950: Insufficient Session Expiration

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

PT-2026-78908

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

PT-2026-78909

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14952: Missing Authentication for Critical Function

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

PT-2026-78910

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

fds-sdk-utils (>=2.0.1, <=2.1.0) potentially affected by CVE-2026-49852 via joserfc (0.11.1)

joserfc PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fds-sdk-utils =2.0.1, =2.1.0 Source cves: CVE-2026-49852 Source advisory: OSV:PYSEC-2026-2528...

fastapi-cognito (>=2.5.0, <=2.7.0), fds-sdk-utils (2.0.0) +3 more potentially affected by CVE-2026-49852 via joserfc (0.9.0)

joserfc PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fastapi-cognito =2.5.0, =0.1.3, =0.18.1, =0.1.0, =0.5.5 Source cves: CVE-2026-49852 Source advisory: OSV:PYSEC-2026-2528...

fastapi-cognito (>=2.5.0, <=2.7.0), fds-sdk-utils (2.0.0) +3 more potentially affected by CVE-2026-27932 via joserfc (0.9.0)

joserfc PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fastapi-cognito =2.5.0, =0.1.3, =0.18.1, =0.1.0, =0.5.5 Source cves: CVE-2026-27932 Source advisory: OSV:PYSEC-2026-2529...

did-sdk-python (>=1.0.0, <=1.1.3), django-ninja-aio-crud (>=1.0.5, <=3.0.1) +9 more potentially affected by CVE-2026-27932 via joserfc (>=1.0.0, <=1.6.1)

joserfc PYPI version =1.0.0, =1.0.0, =1.0.5, =2.6.0, =2.1.1, =3.0.2, =0.21.2, =0.6.0, =0.9.0, =0.1.0, =0.5.0 Source cves: CVE-2026-27932 Source advisory: OSV:PYSEC-2026-2529...

fds-sdk-utils (>=2.0.1, <=2.1.0) potentially affected by CVE-2026-27932 via joserfc (0.11.1)

joserfc PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fds-sdk-utils =2.0.1, =2.1.0 Source cves: CVE-2026-27932 Source advisory: OSV:PYSEC-2026-2529...

fds-sdk-utils (>=2.0.1, <=2.1.0) potentially affected by CVE-2026-49852 via joserfc (0.11.1)

joserfc PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fds-sdk-utils =2.0.1, =2.1.0 Source cves: CVE-2026-49852 Source advisory: OSV:GHSA-GG9X-QCX2-XMRH...