Security Bulletin: IBM WebSphere Application Server Liberty is affected by an improper restriction of XML external entity vulnerability due to RESTEasy (CVE-2026-17615)

Summary There is a vulnerability in the RestEasy library that affects IBM WebSphere Application Server Liberty with restfulWS-3.0, restfulWS-3.1, or restfulWS-4.0 enabled. Vulnerability Details CVEID:CVE-2026-17615 DESCRIPTION: A flaw was found in RESTEasy's SourceProvider. This vulnerability...

Security Bulletin: IBM WebSphere Application Server is affected by a bypass authentication vulnerability (CVE-2026-93907)

Summary IBM WebSphere Application Server is affected by a bypass authentication vulnerability. Vulnerability Details CVEID:CVE-2026-93907 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation...

Security Bulletin: Spring Expression Language (SpEL) in IBM Sterling Control Center makes it vulnerable to Improper Control of Dynamically-Managed Code Resources (CVE-2026-59283)

Summary A Critical vulnerability in Spring Framework that allows a safety guard bypass when evaluating Spring Expression Language SpEL expressions using SimpleEvaluationContext with the expression compiler enabled, potentially leading to unauthorized actions or remote code execution; affected...

openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options

A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon sshd incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (CVE-2026-103499)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service vulnerability. Vulnerability Details CVEID:CVE-2026-103499 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote unauthenticated attacker to cause a denial of...

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

The Norwegian Data Protection Authority DPA has fined Xandr, an advertising unit owned by Microsoft, €8.6 million $9.62 million for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case...

Security Bulletin:A vulnerability in libssh affects IBM SAN Volume Controller, IBM Storage Virtualize and IBM FlashSystem products

Summary A vulnerability in libssh affects IBM Storage Virtualize products and could result in a confidentiality impact. CVE-2025-5318. Vulnerability Details CVEID:CVE-2025-5318 DESCRIPTION: A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered...

Security Bulletin: Vulnerabilities in the kernel and libssh affect IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in libssh and the kernel affect IBM Storage Virtualize products and could cause denial of service and privilege escalation impacts. CVE-2025-5987 CVE-2025-39966 CVE-2025-40176 Vulnerability Details CVEID:CVE-2025-5987 DESCRIPTION: A flaw was found in libssh when using the...

Security Bulletin: Multiple vulnerabilities in the Linux kernel and expat affect IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in the kernel and expat components affect IBM Storage Virtualize products and could cause denial of service and privilege escalation impacts. CVE-2026-43284 CVE-2023-53373 CVE-2025-59375 Vulnerability Details CVEID:CVE-2026-43284 DESCRIPTION: In the Linux kernel, the...

CLSA-2026-1791889844 httpd: Fix of 11 CVEs

CVE-2026-63718: modproxyuwsgi: drop hop-by-hop headers from the backend response - CVE-2026-73636: modauthdigest: accept a one-time nonce only once, also when the client entry was garbage collected - CVE-2026-73637: modauthdigest: don't use a client entry outside the client lock - CVE-2026-48005:...

Product Walkthrough: Bitdefender AI Visibility and Control

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine...

ogmios-queryledgerstate-dump-poc

Ogmios queryLedgerState/dump — Unauthenticated Arbitrary Fil...

K000163682: Perl vulnerability CVE-2026-8376

Security Advisory Description Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perlstudychunk in regcompstudy.c checked the size of the joined...

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been availab...

CVE-2026-104881

Channel access is enforced ONLY by the DataContainer voters "NewsletterChannelAccessVoter" / "NewsletterRecipientsAccessVoter", requiring USERCANEDITCHANNEL, whose "supportsType" fires exclusively for Create/Read/Update/DeleteAction subjects dispatched inside DCTable's create/edit/delete methods...

Security update for python

This update for python fixes the following issues: CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage bsc1273148. CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15806:...

SUSE-SU-2026:4633-1 Security update for python

This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage bsc1273148. - CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. - CVE-2026-15806:...

K000163681: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2025-61662 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invokin...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server, which is a required product for IBM Tivoli Network Manager IP Edition

Summary IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager IP Edition v4.2. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in below mentioned security bulletins. Vulnerability Details Refer to the securit...

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several...