RHLW-2026-A9AFA2D7B2973961 Lightwell Security Advisory: spring-web 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-web 5.3.18.rhlw-00010 with backported fixes for CVE-2016-1000027, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, and CVE-2024-38820. CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution...

Security update for python310

This update for python310 fixes the following issues: CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection bsc1264962. CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806:...

SUSE-SU-2026:4630-1 Security update for python310

This update for python310 fixes the following issues: - CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection bsc1264962. - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. -...

CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-92682

The @neo4j/graphql library (versions 7.0.0 up to but not including 7.6.4 ) contains an incorrect authorization vulnerability where the none quantifier in @authorization filters for relationships and connections fails to negate correctly when translated to Cypher. Consequently, the filter behaves ...

CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

EUVD-2026-97486

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-92682

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-65432, CVE-2026-66142, CVE-2026-66143, CVE-2026-66144, CVE-2026-49875, CVE-2026-10841, CVE-2026-11548, CVE-2026-11549, CVE-2026-11722, CVE-2026-15396, CVE-2026-15412, CVE-2026-15634 in WebSphere Application Server WAS Liberty as...

CVE-2026-109229

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...

CVE-2026-109229

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...

CVE-2026-109229 SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...

CVE-2026-109229

The SGLang framework, through version 0.5.21 , is vulnerable to a denial of service (DoS) condition. The root cause is located in the NanoNemotronVLImageProcessor component, which sets Image.MAX_IMAGE_PIXELS to None, thereby disabling Pillow decompression bomb protection process-wide. Remote atta...

EUVD-2026-97435

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...

CVE-2026-109229 SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...

CVE-2026-109229 SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...

(Post-Quantum) Cryptographic Right Answers

Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. It might feel too soon for an update, but so much has changed. The timeline of the post-quantum transiti...

Bring Your Own Agent: Your Employees' Assistants Are Already Logged In

The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the...

Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albei...