Security Bulletin: Security vulnerability has been identified in WebSphere Application Server and WebSphere Application Server Liberty shipped with IBM Guardium Key Lifecycle Manager (GKLM) (CVE-2026-10842)

Summary WebSphere Application Server and WebSphere Application Server Liberty is shipped as a component of IBM Guardium Key Lifecycle Manager GKLM. Information about security vulnerability affecting WebSphere Application Server and WebSphere Application Server Liberty has been published in a...

Security Bulletin: IBM Engineering Lifecycle Management - DOORS Next is impacted by vulnerability in Apache PDFBox

Summary Vulnerability have been identified in Apache PDFBox, which is used in IBM Engineering Lifecycle Management - DOORS Next. Vulnerability Details CVEID:CVE-2021-27807 DESCRIPTION: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFB...

CVE-2026-20269

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-20269

Technical details (affected product/version/impact/fix) are not publicly provided in the supplied documents. Monitor for updates from Cisco/NVD/CVE sources.

Moderate: Red Hat Security Advisory: libpng security update

An update for libpng is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

MAL-2026-12478 Malicious code in test22221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53 package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTT...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)

Summary IBM WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1, websocket-1.0, websocket-1.1, websocket-2.0...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVE-2026-50645, CVE-2026-9322, CVE-2026-9171)

Summary IBM WebSphere Application Server Liberty using the jaxrs-1.1, jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1 , restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1, jsonp-2.0, jsonp-2.1, jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 features is affected by uncontrolled resource consumption and denial ...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected affected by a server-side request forgery vulnerability (CVE-2026-11546)

Summary IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by an authorization bypass vulnerability (CVE-2026-11714)

Summary IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability with the apiDiscovery-1.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a denial of service vulnerability due to Eclipse Parsson (CVE-2026-9563)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service with the jsonp-2.1 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test Management, Global...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 (CVE-2026-11897)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty are affected by a security bypass vulnerability (CVE-2026-10842)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability with the appSecurity-1.0, appSecurity-2.0 , appSecurity-3.0 or appSecurity-4.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable ...

PT-2026-68236

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description An issue exists involving improper control of a resource through its lifetime, which falls under the Common Weakness Enumeration CWE Pillar CWE-664. This was identified during a...

MAL-2026-11558 Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2026-14529)

Summary WebSphere Application Server is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-14529 DESCRIPTION: IBM...

CVE-2026-64564

CVE-2026-64564 concerns a Linux kernel SCTP DEL-IP processing bug. The vulnerability arises because sctp_process_asconf() caches the ASCONF transport in asconf->transport (tied to chunk->transport) and that transport can be different from the packet source address when looked up via __sctp_...

Russh: Channel-scoped server callbacks can be reached without an open channel

There is a server-side channel state issue in russh. After a client is authenticated, russh can dispatch channel-scoped handler callbacks for recipient channel IDs that were never opened or confirmed. In the strongest reproduced case, the client does not send SSHMSGCHANNELOPEN at all. It...

Chromium: CVE-2026-17722 Object lifecycle issue in WebView

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-17884 Object lifecycle issue in WebRTC

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...