Security Bulletin: Multiple vulnerabilities in IBM SDK, Java technology affect IBM Tivoli Composite Application Manager for Transactions (Response Time)

Summary IBM SDK, Java Technology Edition is used by IBM Tivoli Composite Application Manager for Transactions Response Time. Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CLEANSTART-2026-GG28030 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the sonarqube package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-IG66141 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces

Security vulnerability affects the rundeck package. Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces...

EUVD-2026-92873

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints...

CVE-2026-105762

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-105746

A flaw was found in Docling. The document processing pipeline fails to honor configurations that disable remote network services when utilizing the KServe V2 optical character recognition OCR model. This failure can result in unintended information disclosure, as page images from processed...

CVE-2026-105743

A flaw was found in docling. A remote attacker can exploit a Server-Side Request Forgery SSRF vulnerability by providing crafted URLs when remote resource fetching is enabled. Incomplete validation allows requests to be resolved again by the network client, enabling techniques such as Domain Name...

Rocky Linux 10.1 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc Multiple Vulnerabilities (crlsa-2026_1334)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261334 advisory. glibc: Integer overflow in memalign leads to heap corruption CVE-2026-0861 glibc: glibc: Information disclosure via zero-valued network query...

Linux Distros Unpatched Vulnerability : CVE-2026-104712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal...

Linux Distros Unpatched Vulnerability : CVE-2026-98330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211pernetexit moves any wiphy back to the initial...

Linux Distros Unpatched Vulnerability : CVE-2026-87890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allo...

Security Advisory 0198

Security Advisory 0198 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-102165 CVSSv3.1 Base Score: 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSSv4.0 Base Score: 7.7...

CVE-2025-71383

The Dbit WIFI4 N300 1.0.0 devices are vulnerable to a crash of the management interface. This issue arises from an error in a JSON parser when processing a request from the local Wi-Fi network that lacks a username or password field for the /api/login endpoint. While a reference link is provided,...

SSRF impact in cloud environments: Beyond network reachability

Server-Side request forgery SSRF represents a significant vulnerability class in cloud-hosted services because it directly intersects application behavior with cloud network and identity systems. In the most common case, SSRF is an application-layer vulnerability in which a service accepts...

CVE-2026-106418: Missing Authorization

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

CVE-2026-106385: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. Chromium security severity: Low...

PT-2026-106916

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An issue exists in the Proxy Auth component where incomplete cleanup allows an adjacent attacker to obtain sensitive information by sending crafted network traffic. Recommendations Upda...

CVE-2026-106234: Use After Free

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-106267: Missing Authorization

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106889

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An information leak exists in the Proxy component of Google Chrome on Windows. This issue allows an adjacent attacker to obtain sensitive information by sending crafted network traffic...