PT-2026-88569

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper input validation in Extensions allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one origin can...

CVE-2026-86540

Knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files. An attacker who crafts a malicious .knowns/config.json file in a repository can cause the unvalidated binary path to be executed twice under the user's account with no verificati...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data Vulnerability Details CVEID:CVE-2026-48713 DESCRIPTION: Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation...

CVE-2026-86287

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE-2026-86287

The Net::IP::LPM module for Perl versions before 1.12 is vulnerable to improper input validation because it accepts malformed prefix lengths. Specifically, non-numeric and non-ASCII prefix lengths are treated as 0 , while integers exceeding 31 bits are silently truncated. A single malformed mask ...

CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

[SECURITY] [DSA 6488-1] jbig2dec security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6488-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 07, 2026 https://www.debian.org/security/faq -...

CVE-2026-86501

In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log...

CVE-2026-86501

In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log...

EUVD-2026-72517

In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log...

CVE-2026-86501

JetBrains IntelliJ IDEA versions prior to 2026.2.2 allow terminal command input to be written to the application's idea.log file. This is a low-severity local information disclosure (CVSS 3.1 score 2.8 , vector AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) requiring local access, low privileges, and user ...

CVE-2026-86501

In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log...

SUSE CVE-2026-80771

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set inputregisterdevice exposes the device to userspace immediately. In joyconinputcreate it was called before joyconconfigrumble configures the FFRUMBLE capability and...

Security update for bzip2

This update for bzip2 fixes the following issue: CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash bsc1266786. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupda...

CVE-2026-86452

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or...

CVE-2026-19843 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

Security update for libusb-1_0

This update for libusb-10 fixes the following issue: CVE-2026-23679: NULL pointer dereference in parseinterface allows attackers to crash applications by supplying a malformed USB configuration descriptor bsc1266664. Patch Instructions: To install this SUSE update use the SUSE recommended...

CVE-2026-12757

The Email Subscribers & Newsletters WordPress plugin is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.9.27 . The root cause is that the plugin's subscription-handling logic does not properly validate user-supplied input (the subscriber name fiel...

DEBIAN-CVE-2026-86432

commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausti...

DEBIAN-CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...