CVE-2026-109229

The SGLang framework, through version 0.5.21 , is vulnerable to a denial of service (DoS) condition. The root cause is located in the NanoNemotronVLImageProcessor component, which sets Image.MAX_IMAGE_PIXELS to None, thereby disabling Pillow decompression bomb protection process-wide. Remote atta...

(Post-Quantum) Cryptographic Right Answers

Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. It might feel too soon for an update, but so much has changed. The timeline of the post-quantum transiti...

Bring Your Own Agent: Your Employees' Assistants Are Already Logged In

The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the...

Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albei...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an HTTP request smuggling vulnerability due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Integrated Analytics System as a web server and servlet container. CVE-2026-19203 affects Eclipse Jetty due to accepting a lone line-feed LF character as a terminator in chunked request parsing such as in chunk extensions, chunk data termination, or trailer...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a path traversal vulnerability due to Apache Ant

Summary Apache Ant is used by IBM Integrated Analytics System as a Java-based build and task execution tool. CVE-2026-78254 affects Apache Ant versions prior to 1.10.18, where the ftp and scp tasks allow a malicious server or a machine-in-the-middle attacker to provide relative paths during file...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components

Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) CallHome component is affected by multiple vulnerabilities

Summary The CallHome component in IBM Cloud Pak for Data System 1.0 includes several open-source and third-party frameworks and packages as part of its management and diagnostic infrastructure. Multiple security vulnerabilities have been identified in underlying components, including Django, Go...

Exploit for Missing Authorization in Mongodb

CVE-2026-13078 POC Original PoC coded and developed by Ad3M...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch releases of Callhome. Vulnerability Details CVEID:CVE-2026-11824 DESCRIPTION: SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-23216 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in...

Security Bulletin: IBM Application Modernization Accelerator is affected by vulnerability found in JavaScript

Summary There is a vulnerability in the JavaScript used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-17495 DESCRIPTION: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a...

Security Bulletin: IBM Transformation Advisor is affected by vulnerability found in JavaScript

Summary There is a vulnerability in the JavaScript used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-17495 DESCRIPTION: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted...

Security Bulletin:Vulnerabilities exists in zstd package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-89045 DESCRIPTION: zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in...

Security Bulletin:Vulnerabilities exists in zstd package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-87795 DESCRIPTION: zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor,...

Security Bulletin:Vulnerabilities exists in Zookeeper package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-59739 DESCRIPTION: Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can...

Security Bulletin:Vulnerabilities exists in Spring package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-59282 DESCRIPTION: Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths on...

Security Bulletin:Vulnerabilities exists in Parquet package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-73334 DESCRIPTION: Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to...

Security Bulletin:Vulnerabilities exists in Golang package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-46597 DESCRIPTION: An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for...

Security Bulletin:Vulnerabilities exists in Github package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-83530 DESCRIPTION: A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on th...