K000163267: Linux kernel vulnerabilities CVE-2024-35868 and CVE-2023-52513

Security Advisory Description CVE-2024-35868 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifsstatsprocwrite Skip sessions that are being teared down status == SESEXITING to avoid UAF. CVE-2023-52513 In the Linux kernel, the following...

OPENSUSE-SU-2026:21823-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

SUSE-SU-2026:23700-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

SUSE-SU-2026:23720-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

MAL-2026-16121 Malicious code in websetup (PyPI)

[email protected] is a single module whose only function, setup.settext=None, filepath=None in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook id 1546817174411288617; the name Discord returns for it is "backdoor" and swallows every...

Malicious code in websetup (PyPI)

[email protected] is a single module whose only function, setup.settext=None, filepath=None in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook id 1546817174411288617; the name Discord returns for it is "backdoor" and swallows every...

Exploit for CVE-2026-74586

CVE-2026-74586 — SCTP ASCONF newtransport use-after-free trig...

Security Bulletin: Vulnerabilities in Spring, Tomcat, Netty, PostCSS might affect IBM Storage Protect Plus

Summary IBM Spectrum Protect Plus can be affected by vulnerabilities in PostCSS, Spring, HttpClient, Netty, Tomcat, Jackson-Core, RabbitMQ, urllib3, and Node.js. Vulnerabilities include exposure of sensitive information to an unauthorized actor, authentication bypass by primary weakness, improper...

Exploit for CVE-2026-67276

RouterOS SSH Modulus-Confusion Validator CVE-2026-67276 An...

halo-record v0.2.42

halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your instrumentation captures tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only,...

Exploit for CVE-2026-67401

CVE-2026-67401 — cPanel & WHM EmailTrack SQL Injection → Root...

Security Bulletin:Vulnerabilities exists in NPS of IBM Netezza Appliance

Summary Vulnerabilities identified in NPS of IBM Netezza Software have been addressed in version 11.3.1.3-IF3. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway for Multiplatforms, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback, Log4j, Jackson Databind, and various operating system...

Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to Improper Encoding or Escaping of Output

Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34479 Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard,...

Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to ImproperImproper Encoding or Escaping of Output

Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34480 Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including...

Exploit for Allocation of Resources Without Limits or Throttling in Redis

CVE-2021-32675 – Redis Pre-Allocation Denial of Service OOM...

The push to stop algorithms controlling social media feeds has begun

Remember when social media was filled only with posts from your friends, rather than what an algorithm decided you wanted to see? So does the Australian government, and it wants that internet back. Yesterday, the government released draft legislation outlining a Digital Duty of Care. The proposal...

Security Bulletin: IBM Db2 Bridge is vulnerable due to baseline-browser-mapping, sqlparse, cryptography, Browserslist (CVE-2026-45819,CVE-2026-84305,CVE-2026-69247,CVE-2026-73088,CVE-2026-73089,CVE-2026-54284,CVE-2026-59893,CVE-2026-59894,CVE-2026-71491)

Summary baseline-browser-mapping, sqlparse, cryptography, Browserslist is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5 and new Fix pack was release to address the issue. Vulnerability...

K000163263: Go vulnerability CVE-2026-32952

Security Advisory Description go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version...

Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud is using crypto packages which is vulnerable to CVE-2026-32283 and CVE-2026-32281

Summary This release addresses security vulnerabilities in application and operator images of ELM on Hybrid Cloud. The identified vulnerabilities relate to Go standard library packages crypto/tls and crypto/x509, which impact the product within the deployed environment. The vulnerabilities are...