postgresql: postgresql: Incorrect trigger row processing via partitioned table MERGE

A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can cause automated database rules AFTER triggers to process incorrect row data by running a MERGE operation on a partitioned table that inserts records before updating them. This failure to maintain...

python: python: Misinterpretation of HTTP responses via invalid chunk parsing

A flaw was found in Python. Its Hypertext Transfer Protocol HTTP response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the applicatio...

CVE-2026-116312

A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can cause automated database rules AFTER triggers to process incorrect row data by running a MERGE operation on a partitioned table that inserts records before updating them. This failure to maintain...

kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU

A flaw was found in the Linux kernel's SCSI subsystem within the libiscsi module. A malicious or compromised iSCSI storage target can trigger a denial of service DoS or data integrity issues by sending a crafted Reject Protocol Data Unit PDU containing an unvalidated Initiator Task Tag ITT. Becau...

kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU

A flaw was found in the Linux kernel's SCSI subsystem within the libiscsi module. A malicious or compromised iSCSI storage target can trigger a denial of service DoS or data integrity issues by sending a crafted Reject Protocol Data Unit PDU containing an unvalidated Initiator Task Tag ITT. Becau...

Vulnerability fixed in Fortinet FortiSandbox

Fortinet has addressed a vulnerability in multiple versions of FortiSandbox. The vulnerability is a Cross-Site Scripting XSS issue resulting from insufficient input sanitization during web page generation. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTT...

python: python: Misinterpretation of HTTP responses via invalid chunk parsing

A flaw was found in Python. Its Hypertext Transfer Protocol HTTP response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the applicatio...

python: python: Misinterpretation of HTTP responses via invalid chunk parsing

A flaw was found in Python. Its Hypertext Transfer Protocol HTTP response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the applicatio...

python: python: Misinterpretation of HTTP responses via invalid chunk parsing

A flaw was found in Python. Its Hypertext Transfer Protocol HTTP response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the applicatio...

python: python: Misinterpretation of HTTP responses via invalid chunk parsing

A flaw was found in Python. Its Hypertext Transfer Protocol HTTP response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the applicatio...

python: python: Misinterpretation of HTTP responses via invalid chunk parsing

A flaw was found in Python. Its Hypertext Transfer Protocol HTTP response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the applicatio...

python: python: Misinterpretation of HTTP responses via invalid chunk parsing

A flaw was found in Python. Its Hypertext Transfer Protocol HTTP response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the applicatio...

CVE-2026-99101

A flaw was found in the Linux kernel's NTFS file system driver. When clearing compression or sparse file flags, the driver shrinks an internal attribute record before shifting its contents, which overwrites part of the record with adjacent data. A local user could exploit this behavior by changin...

CVE-2026-116486

A flaw was found in Objenesis. The library caches object instantiators using only the class name rather than the unique class identity across separate class loaders. A local attacker can exploit this behavior in shared caching environments with identically named classes to induce type confusion...

CVE-2026-89857

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs because a specific function responsible for sending NVMe Local-Scope LS rejects does not properly acquire a necessary lock. This oversight allows for concurrent operations, which can corrupt the internal state o...

CVE-2026-89915

A flaw was found in the Kernel-based Virtual Machine KVM for ARM64 architectures. The VM-wide VNCR mapping counter, a mechanism designed to optimize Translation Lookaside Buffer TLB invalidations, contained several issues. These flaws could lead to situations where TLB entries are not correctly...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to input validation bypass and data integrity issues in UltraJSON (CVE-2026-54911)

Summary IBM Watson Speech Services Cartridge is vulnerable to input validation bypass and data integrity issues in UltraJSON, due to a flaw that allows the encoder/decoder to accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of...

CVE-2026-113602

A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute 0x1A character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept...

CVE-2026-89855

A flaw was found in the Linux kernel's scsi: qla2xxx component. A local attacker could exploit a race condition in the flash version read handler. By concurrently triggering a sysfs reset operation and other flash operations, an attacker could corrupt flash register reads. This could lead to data...

CVE-2026-93147

A flaw was found in the kernel. The s390/bpf component incorrectly handles the loading of a 32-bit CPU number cpunr into a 64-bit BPF register BPFREG0. The ly instruction, used for this operation, fails to clear the upper bits of the 64-bit register. This oversight could lead to the unintended...