AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

Untrusted Sender DN Used as Format String in CMP Response Validation

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

!/usr/bin/env python3 """ CVE-2026-42167 — ProFTPD modsql post-authentication SQL injection - RCE postauthstorrce.py --host --port 21 \ --user --password \ --shell-host --shell-port 4444 SUMMARY ------- ProFTPD's modsql logs FTP activity through user-supplied SQL. Its escaping helper isescapedtex...

OpenSSL 3.4.0 < 3.4.7 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.4.7. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.4.7 advisory. - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and n...

PT-2026-86154

Summary The utcp-http library = 1.1.3 unconditionally trusts the tokenUrl field embedded in remote OpenAPI security schemes. When a victim registers an attacker-controlled OpenAPI spec and invokes any generated OAuth2-protected tool, the library POSTs the victim's client id and client secret to t...

UBUNTU-CVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count CVE-2026-53392 In the Linux kernel, the following vulnerability has been resolved: nfsd: reset write verifier on deferred writeback errors CVE-2026-53393 In th...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2024-34459...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Insufficiently Protected Credentials in go-git [GHSA-3xc5-wrhm-f963]

Summary IBM Watson Speech Services Cartridge is vulnerable to Insufficiently Protected Credentials in go-git, due to a potential leak of HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations GHSA-3xc5-wrhm-f963. Go-git is used in our...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a heap overflow in NLnet Labs Unbound [CVE-2026-42944]

Summary IBM Watson Speech Services Cartridge is vulnerable to a heap overflow in NLnet Labs Unbound, due to an issue that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet CVE-2026-42944. NLnet Labs Unbound is used as part ...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to improper encoding in Apache Log4j [CVE-2026-49844]

Summary IBM Watson Speech Services Cartridge is vulnerable to Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API, which produces output that is not valid JSON CVE-2026-49844. Apache Log4j is included in our speech microservices. This...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in PostgreSQL [CVE-2026-6473]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in PostgreSQL, due to an Integer wraparound in multiple server features which can allow an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds CVE-2026-6473. PostgreSQL is used as par...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND [CVE-2026-3039]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND, due to a flaw in BIND servers that are configured to use TKEY-based authentication via GSS-API tokens, which makes them vulnerable to excessive memory consumption when receiving and processing maliciously-constructed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in NLnet Labs Unbound [CVE-2026-33278]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in NLnet Labs Unbound, due to a flaw in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a privilege escalation in PostgreSQL [CVE-2026-6475]

Summary IBM Watson Speech Services Cartridge is vulnerable to a privilege escalation due to an issues in PostgreSQL pgbasebackup plain format and in pgrewind that allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to credential exposure in PostgreSQL [CVE-2026-6478]

Summary IBM Watson Speech Services Cartridge is vulnerable to credential exposure in PostgreSQL, due to covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication which allows an attacker to recover user credentials sufficient to authenticate CVE-2026-6478. PostgreSQL...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in NLnet Labs Unbound [CVE-2026-42959]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in NLnet Labs Unbound, due to a flaw in the DNSSEC validator that can lead to a crash given malicious upstream replies. CVE-2026-42959. NLnet Labs Unbound is used in our service speech utilities. This vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND [CVE-2026-5946]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND, due to multiple flaws causing an Improper Input Validation CVE-2026-5946. ISC BIND is used as part of our speech utilities. This vulnerability has been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery (SSRF) vulnerability in kubernetes [CVE-2025-13281]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery SSRF vulnerability in kubernetes, due to an issue in kube-controller-manager when using the in-tree Portworx StorageClass CVE-2025-13281. Kubernetes is used as part of our speech utilities. This...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an out-of-bounds read in onnx [CVE-2026-14647]

Summary IBM Watson Speech Services Cartridge is vulnerable to an out-of-bounds read in onnx that affects the function convPoolShapeInferenceopset19 of the file onnx/defs/nn/old.cc of the component onnxruntime CVE-2026-14647. Onnx is used as part of our service runtimes. This vulnerability has bee...