CVE-2026-18246 IBM i is Affected By security restrictions bypass in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

SUSE CVE-2026-71391

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

SUSE CVE-2026-71394

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

CVE-2026-15803

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

CVE-2026-14479

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...

CVE-2026-14479

CVE-2026-14479 affects the Autodesk Installer IPC frame parser. A maliciously crafted input can cause improper validation of an input-specified position or offset, producing an out-of-range substring operation. The resulting condition may cause the NT AUTHORITY\SYSTEM service to terminate, yieldi...

EUVD-2026-57239

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...

“Zoomsday” flaws could let one Zoom participant attack another

Researchers have found three vulnerabilities in the popular Zoom meeting platform that could let one meeting participant attack another through malicious collaboration data. The vulnerabilities, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, affect the code Zoom uses to process...

Winter: Stored XSS through Editor Settings custom styles

Impact Authenticated Backend Users with the backend.manageeditor "Manage editor settings" permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was n...

Winter: Stored XSS through Brand Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...

CLSA-2026-1786525960 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.2...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in jackson-core jar (CVE-2026-18401, CVE-2026-68494)

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-18401 and CVE-2026-68494 reported for jackson-core-2.17.1.jar Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength...

ROS-20260812-73-0025

The vulnerability of the Wireshark parser for analyzing BLF files related to traffic analysis in computer networks is linked to errors during initialization. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protected by security measures...

PT-2026-71353

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description A buffer overflow exists in the IXF IMPORT parser. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is...

PT-2026-80102

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.2...

PT-2026-71136

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

PT-2026-78856

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description A crash in the 3gpp phone log file parser allows for a denial of service. This is caused by an out-of-bounds write, which occurs when the software write...

CVE-2026-18952: Server-Side Request Forgery (SSRF)

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...

glib2 security update

2.56.1-9.0.7 - Fixes CVE-2026-58016 Orabug: 39844471 2.56.1-9.0.5 - Fixes CVE-2025-14078 gvariant parser buffer underflow Orabug: 39418716 2.56.1-9.0.3 - Fixes CVE-2025-13601 gescapeuristring overflow Orabug: 38909821 2.56.1-9.0.1 - Fix overflow of GDBusConnection serial Orabug: 38666376...

PT-2026-71210

Name of the Vulnerable Software and Affected Versions OpenSearch Security Analytics plugin affected versions not specified Description Missing input validation in the threat intelligence feed parser allows an authenticated remote user to perform server-side request forgery SSRF—a technique where ...