Security Bulletin:Vulnerability in Vite affects IBM Netezza Appliance

Summary The Vite package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-53571, CVE-2026-53632 Vulnerability Details CVEID:CVE-2026-53571 DESCRIPTION: Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the...

CVE-2026-68393 Bluetooth: hci_sync: extend conn_hash lookup critical sections

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68393

The CVE-2026-68393 entry concerns the Linux kernel Bluetooth hci_sync component. The root cause is the use of RCU-protected pointers outside their critical sections without proper reference counting, which could lead to a Use-After-Free (UAF). The fix extends the critical section to cover both th...

EUVD-2026-55579

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

EUVD-2026-55292

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...

Security Bulletin: Immutable.js Denial of Service Vulnerabilities in Content Cortex for Microsoft Office

Summary Immutable.js versions before 4.3.9 and 5.1.8 have two DoS vulnerabilities CVSS 7.5, High. CVE-2026-59879 is an integer overflow in List operations set, setSize, setIn, updateIn that can cause infinite loops or unbounded memory allocation when given index/size values between 2^30 and 2^31...

PT-2026-69793

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where RCU-protected pointers are used outside of critical sections without a refcount, which may lead to a Use-After-Free UAF condition. UAF...

CVE-2026-48048: Exposure of Private Personal Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to...

PT-2026-69519

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the construction of standalone TCP responses using TCP-AO TCP Authentication Option options. The functions tcp v4 send ack and tcp v6 send response create responses...

SPIP Unauthenticated Blind SQLi via Date Field Escaping Bypass

This module exploits an unauthenticated blind SQL injection in SPIP use auxiliary/scanner/http/spip/anneesqli msf undefinedanneesqli show actions ...actions... msf undefinedanneesqli set ACTION msf undefinedanneesqli show options ...show and set options... msf undefinedanneesqli run This module...

DEBIAN-CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

EUVD-2026-54850

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

PT-2026-76565

Name of the Vulnerable Software and Affected Versions WeeChat versions 0.3.1 through 4.9.0 Description Relay authentication uses non-constant-time string comparison functions weechat strcasecmp and strcmp to verify password hashes and plaintext passwords. This allows an attacker to use timing...

PT-2026-69246

Name of the Vulnerable Software and Affected Versions Crypt::OpenSSL::PKCS12 versions prior to 1.98 Description A NULL pointer dereference occurs in the print attribute function when processing a zero length BMPSTRING attribute. The function uses Renewattribute, length, char to size the destinati...

SUSE SLES15: libpython3_10-1_0 / python310 / python310-base / python310-curses / etc (SUSE-SU-2026:3530-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3530-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when t...

CVE-2026-19282

A weakness has been identified in andreahaku llmmemorymcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llmmemorymcp. Executing a manipulation of the argument hash can lead to command injection...

CVE-2026-19282 andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection

A weakness has been identified in andreahaku llmmemorymcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llmmemorymcp. Executing a manipulation of the argument hash can lead to command injection...

CVE-2026-19282

The CVE describes a local command-injection risk in the andreahaku llm_memory_mcp project, affecting the auto.capture function in src/autolearn/GitHooksManager.ts. The root cause is a manipulation of the argument hash, enabling injection, with exploitation restricted to local access. No product v...

Malicious code in sme-rko-finance-front-operations-widget-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1cadf7bdbe8322e1878572d42f769a267d9a2af7a61c0da00f02c1436799824 index.js requires./setup on load, which selects a platform-specific binary path linux/darwin/win32 and fetches an opaque native executable from one o...

MAL-2026-13651 Malicious code in sme-rko-finance-front-operations-widget-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1cadf7bdbe8322e1878572d42f769a267d9a2af7a61c0da00f02c1436799824 index.js requires./setup on load, which selects a platform-specific binary path linux/darwin/win32 and fetches an opaque native executable from one o...