Linux Distros Unpatched Vulnerability : CVE-2026-17072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a...

Linux Distros Unpatched Vulnerability : CVE-2026-49158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0...

Linux Distros Unpatched Vulnerability : CVE-2026-58389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are...

Linux Distros Unpatched Vulnerability : CVE-2026-41608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0...

Oracle APEX (CVE-2026-60156) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: General as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: General. Easily exploitable vulnerability allows unauthenticated attacker with network...

Linux Distros Unpatched Vulnerability : CVE-2026-43871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before...

Linux Distros Unpatched Vulnerability : CVE-2026-51235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch function src/librawcxx.cpp and fujirotate function src/decoders/fuji.cpp. CVE-2026-51235 Note that...

PT-2026-65486

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...

TSIG packet with name compression can crash DNS

== Summary: Incorrect size calculations when a TSIG record contains compressed names can lead to a large out-of-bounds write causing the server to crash. Description To calculate the size of a DNS packet region signed by a TSIG record, Samba's internal DNS server subtracted the presumed size of t...

The CTDB protocol has bounds checking issues

== Summary: CTDB fails to do integrity checking of received packets. This includes failure to check field lengths against packet lengths when unmarshalling packets. Description CTDB fails to do a number of integrity checks on received packets. This includes: checking of field lengths against pack...

Oracle Java Critical Patch Update Advisory April 2026

CVE-2026-22007 - Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

SUSE SLES15 Security Update : kernel (Live Patch 28 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:3289-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3289-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.113 fixes various security issues: The following security issues were fixed:...

Linux Distros Unpatched Vulnerability : CVE-2026-17574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type fie...

Linux Distros Unpatched Vulnerability : CVE-2026-64537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itse...

SUSE SLES15 Security Update : kernel RT (Live Patch 17 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3253-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3253-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.62 fixes various security issues: The following security issues were fixed: -...

Malicious code in dot-utils-plus (npm)

Source: amazon-inspector 3091b9bb8cbf714d9391a59f7303a3748e183bbdf0fba2264b7496a2072e717f On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable VITEDOTUTILSAESSECRET, decrypts the result into JavaScript source, wraps it in a...

Malicious code in chai-as-patch (npm)

Source: amazon-inspector c0f6b316992ec48b2d29d234f9debebcf239653a2371d54ab9f6e487c4fdba7b This package is a typosquat of chai-as-promised that delivers remote code execution to any installer that requires it and invokes the exported middleware. index.js spawns a detached, stdio-ignored child...

CVE-2026-28900

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a code inconsistency in Bouncy Castle [CVE-2026-8149]

Summary IBM Watson Speech Services Cartridge is vulnerable to a code inconsistency in Bouncy Castle packages: BC-LTS on Linux, X8664, AVX, AVX-512f CVE-2026-8149. Bouncy Castle is used in our speech microservices. This vulnerability has been addressed. Please read the details for remediation belo...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangSmith [CVE-2026-45134]

Summary IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangSmith, due to issues with an earlier version of the SDK's prompt pull methods and deserialize prompt manifests from the LangSmith Hub CVE-2026-45134. LangSmith is used in our runtime...