Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational [CVE-2026-41697]

Summary IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational, due to a failure to properly escape binding values of externally-controlled input hat can allow an attacker can supply wildcard characters CVE-2026-41697. Spring Data Relational, is used as par...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service ReDoS in Spring Framework CVE-2026-41848. Spring Framework is used as part of our microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple D.o.S. issues in Micrometer [CVE-2026-40983, CVE-2026-40984]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple D.o.S. issues in Micrometer due to issues in CVE-2026-40983, CVE-2026-40984. Micrometer is used in our speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerabili...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith [CVE-2026-41182]

Summary IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith, due to an issue that causes a bypass of the redaction pipeline CVE-2026-41182. LangSmith is used in our runtime postprocessor. This vulnerability has been addressed. Please read the details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Moby [CVE-2026-34040]

Summary IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Moby, due to a flaw that allows attackers to bypass authorization plugins AuthZ CVE-2026-34040. Moby is used in our speech catalog. This vulnerability has been addressed. Please read the details for remediati...

ROOT-OS-UBUNTU-2204-CVE-2023-25564 CVE-2023-25564 in rootio-gss-ntlmssp - Patched by Root

Root has patched CVE-2023-25564 in the rootio-gss-ntlmssp package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2022-41409 CVE-2022-41409 in rootio-pcre2 - Patched by Root

Root has patched CVE-2022-41409 in the rootio-pcre2 package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2023-25565 CVE-2023-25565 in rootio-gss-ntlmssp - Patched by Root

Root has patched CVE-2023-25565 in the rootio-gss-ntlmssp package for Root:Ubuntu:22.04. Multiple fixed versions available...

Important: Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 security update

An update for kpatch-patch-6120-211161 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ROOT-OS-UBUNTU-2204-CVE-2018-6952 CVE-2018-6952 in rootio-patch - Patched by Root

Root has patched CVE-2018-6952 in the rootio-patch package for Root:Ubuntu:22.04. Multiple fixed versions available...

EUVD-2026-49390

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local,...

EUVD-2026-49386

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...

CVE-2026-48030 Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...

Security update for the Linux Kernel RT (Live Patch 16 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.59 fixes various security issues: The following security issues were fixed: CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. CVE-2026-53366: ipv4: account for fraggap on the paged allocati...

SUSE-SU-2026:3301-1 Security update for the Linux Kernel RT (Live Patch 16 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.59 fixes various security issues: The following security issues were fixed: - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. - CVE-2026-53366: ipv4: account for fraggap on the paged...

Security update for ImageMagick

This update for ImageMagick fixes the following issue: Extend CVE-2026-56379 patch by f63c78b bsc1268878. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your...

SUSE-SU-2026:3298-1 Security update for ImageMagick

This update for ImageMagick fixes the following issue - Extend CVE-2026-56379 patch by f63c78b bsc1268878...

CVE-2026-17529

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astrmainagent.py. The manipulation of the argument req.functool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available an...

CVE-2026-17530

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function buildhandofftoolset of the file AstrBot/astrbot/core/astragenttoolexec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be...

CVE-2026-17530 AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function buildhandofftoolset of the file AstrBot/astrbot/core/astragenttoolexec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be...