Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.320 Vulnerability Details CVEID:CVE-2026-42009 DESCRIPTION: A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Securit...

PT-2026-53242

A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown function of the file /admin/mod amenities/controller.php?action=add. Executing a manipulation of the argument image can lead to unrestricted upload. It is possible to launch the attack remotely. The...

Important: containerd

Issue Overview: Memory exhaustion DoS causing OOM kill of containerd process NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq CVE-2026-47262 Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution NOTE:...

PT-2026-53634

Summary A chain of vulnerabilities in vLLM allow Remote Code Execution RCE: 1. Info Leak - PIL error messages expose memory addresses, bypassing ASLR 2. Heap Overflow - JPEG2000 decoder in OpenCV/FFmpeg has a heap overflow that lets us hijack code execution Result: Send a malicious video URL to...

RHEL 7 : ImageMagick (RHSA-2026:32961)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:32961 advisory. ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fixe...

Important: containerd

Issue Overview: Memory exhaustion DoS causing OOM kill of containerd process NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq CVE-2026-47262 Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution NOTE:...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: atm: fix crash due to unvalidated vcc pointer in sigdsend CVE-2026-31411 kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 Bug Fixes and Enhancements: AlmaLinux 9.8...

Linux Distros Unpatched Vulnerability : CVE-2026-56376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale...

Linux Distros Unpatched Vulnerability : CVE-2026-56371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated...

OPENSUSE-SU-2026:21074-1 Security update for loupe

This update for loupe fixes the following issue - CVE-2025-58160: tracing-subscriber: untrusted input containing ANSI escape sequences can lead to terminal manipulation bsc1249009. Changes for loupe: - Update to version 48.2: - Check if the is-hidden property is available before reading it. -...

RLSA-2023:3067 Moderate: autotrace security update

AutoTrace is a program for converting bitmaps to vector graphics. Security Fixes: autotrace: heap-buffer overflow via the ReadImage at input-bmp.c CVE-2022-32323 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer t...

Linux Distros Unpatched Vulnerability : CVE-2026-28385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with t...

WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Aurélien BOURDOIS Elymaro in WordPress Plugin nicen-localize-image versions = 1.4.9...

CVE-2026-49414

The FreeBSD kernel contains a vulnerability (CVE-2026-49414) where the ELF image activator clears per-process ASLR preference flags for setuid binaries after the code computes the PIE base address. This allows an unprivileged local user to call procctl(2) before execve(2) to disable ASLR, simplif...

CVE-2026-49414: Incorrect Behavior Order: Early Validation

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user ca...

RockyLinux 9 : autotrace (RLSA-2023:2589)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:2589 advisory. autotrace: heap-buffer overflow via the ReadImage at input-bmp.c CVE-2022-32323 Tenable has extracted the preceding description block directly from the RockyLinux...

SUSE SLES12 Security Update : exiv2 (SUSE-SU-2026:2663-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2663-1 advisory. This update for exiv2 fixes the following issues - CVE-2025-54080: out-of-bounds read in Exiv2::EpsImage::writeMetadata when writing metadata...

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

An crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder...

EUVD-2026-36191

ImageMagick: Memory Leak in wand option parser when providing invalid arguments...

GHSA-QVQC-4C52-X6QP regclient may leak authentication credentials to external blob stores

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...