Oracle Java Critical Patch Update Advisory April 2026

CVE-2026-22007 - Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

CVE-2026-28900

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks...

EUVD-2026-49503

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or...

CVE-2026-43754

Summary: CVE-2026-43754 affects macOS where an app could leak sensitive kernel state. The issue is addressed in macOS updates Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. The description notes improved redaction of sensitive information as the fix. The connected sources corroborate a macOS-focu...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents [CVE-2026-54428]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents due to a flaw in HTTP/2 HPACK decoder which could lead to a D.O.S. CVE-2026-54428. Apache HttpComponents is used in our Java Microservices...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service ReDoS in Spring Framework CVE-2026-41848. Spring Framework is used as part of our microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple D.o.S. issues in Micrometer [CVE-2026-40983, CVE-2026-40984]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple D.o.S. issues in Micrometer due to issues in CVE-2026-40983, CVE-2026-40984. Micrometer is used in our speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerabili...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Moby [CVE-2026-34040]

Summary IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Moby, due to a flaw that allows attackers to bypass authorization plugins AuthZ CVE-2026-34040. Moby is used in our speech catalog. This vulnerability has been addressed. Please read the details for remediati...

ROOT-OS-UBUNTU-2204-CVE-2023-25564 CVE-2023-25564 in rootio-gss-ntlmssp - Patched by Root

Root has patched CVE-2023-25564 in the rootio-gss-ntlmssp package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2023-25565 CVE-2023-25565 in rootio-gss-ntlmssp - Patched by Root

Root has patched CVE-2023-25565 in the rootio-gss-ntlmssp package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2022-41409 CVE-2022-41409 in rootio-pcre2 - Patched by Root

Root has patched CVE-2022-41409 in the rootio-pcre2 package for Root:Ubuntu:22.04. Multiple fixed versions available...

Important: Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 security update

An update for kpatch-patch-6120-211161 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ROOT-OS-UBUNTU-2204-CVE-2018-6952 CVE-2018-6952 in rootio-patch - Patched by Root

Root has patched CVE-2018-6952 in the rootio-patch package for Root:Ubuntu:22.04. Multiple fixed versions available...

EUVD-2026-49386

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...

Security update for the Linux Kernel RT (Live Patch 16 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.59 fixes various security issues: The following security issues were fixed: CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. CVE-2026-53366: ipv4: account for fraggap on the paged allocati...

SUSE-SU-2026:3301-1 Security update for the Linux Kernel RT (Live Patch 16 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.59 fixes various security issues: The following security issues were fixed: - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. - CVE-2026-53366: ipv4: account for fraggap on the paged...

Security update for ImageMagick

This update for ImageMagick fixes the following issue: Extend CVE-2026-56379 patch by f63c78b bsc1268878. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your...

SUSE-SU-2026:3298-1 Security update for ImageMagick

This update for ImageMagick fixes the following issue - Extend CVE-2026-56379 patch by f63c78b bsc1268878...

CVE-2026-17529

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astrmainagent.py. The manipulation of the argument req.functool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available an...

CVE-2026-17530

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function buildhandofftoolset of the file AstrBot/astrbot/core/astragenttoolexec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be...