Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime affect IBM Sterling External Authentication Server

Summary Multiple vulnerabilities in IBM® Semeru Runtime Environment Version 17 affect IBM Sterling External Authentication Server and are addressed in the latest release and fixpack Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated...

BIT-DOTNET-SDK-2026-47300 ASP.NET Core Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

BIT-DOTNET-2026-47300 ASP.NET Core Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

K000162459: PHP vulnerabilities CVE-2026-12184 and CVE-2026-14355

Security Advisory Description CVE-2026-12184 The cve record for the cve id does not exist. CVE-2026-14355 In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.321 Vulnerability Details CVEID:CVE-2026-8643 DESCRIPTION: pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved...

K000162458: Multiple WolfSSL vulnerabilities

Security Advisory Description CVE-2026-6679 A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized...

Ivanti vTM - Authentication Bypass

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. id: CVE-2024-7593 info: name: Ivanti vTM - Authentication Bypass author: gy741 severity: critical...

K000162457: Linux kernel vulnerability CVE-2026-53106

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: bpf: Do not allow deleting local storage in NMI Currently, local storage may deadlock when deferring freeing selem or local storage through kfreercu, callrcu or callrcutaskstrace in NMI or reentrant...

[SECURITY] Fedora 43 Update: trafficserver-10.1.3-1.fc43

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

[SECURITY] Fedora 44 Update: trafficserver-10.1.3-1.fc44

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

PT-2026-65002

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

CVE-2026-51304

CVE-2026-51304 relates to sqlite3 3.41 with a use-after-free (UAF) in the ORDER BY clause parsing routine. The code releases memory of an ExprList via sqlite3ExprListDelete(), then accesses the freed object’s nExpr, producing an invalid memory read. By crafting a malicious SQL statement with a la...

CVE-2026-51296

SQLite 3.41 has a use-after-free vulnerability in the JSON module’s jsonRemoveFunc. The parsed JSON object is freed at line 3555 while jsonLookupStep is called on the released pointer at line 3575, enabling remote attackers to crash the service and potentially leak heap memory information. Affect...

CVE-2026-51235

LibRaw 0.21 contains a buffer overflow in the stretch() and fuji_rotate() functions. Red Hat’s advisory states the issue is a vulnerability in the LibRaw library that could allow memory overwrite, potentially leading to denial of service or unauthorized code execution. Mitigation: avoid processin...

CVE-2026-51303

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-51297

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-51298

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2026-65018

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ext4: replace BUGON with proper error handling in ext4readinlinefolio CVE-2026-31451 In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache...

CVE-2026-51302

SQLite 3.41 contains a use-after-free in the expression evaluation logic: sqlite3ReleaseTempReg frees temporary registers, but exprComputeOperands may access freed memory. This could allow a remote attacker to cause DoS, leak data, or potentially execute arbitrary code. The connected docs do not ...