Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended...

RLSA-2026:42063 Important: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer underflow in...

CVE-2026-45383

A flaw was found in libde265, an open-source implementation of the H.265 video codec. A remote attacker could exploit a heap buffer overflow vulnerability by providing specially crafted video files. This occurs when decoding a Wavefront Parallel Processing WPP HEVC slice, where malformed headers...

SUSE-SU-2026:3178-1 Security update for nasm

This update for nasm fixes the following issues - CVE-2026-6067: heap buffer overflow vulnerability due to a lack of bounds checking in the objdirective function bsc1261986. - CVE-2026-6068: heap use after free vulnerability in response file processing bsc1261985...

Security Bulletin: Multiple Vulnerabilities in IBM Event Processing

Summary Multiple vulnerabilities were addressed. Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data via JSON...

glibc: glibc: Out-of-bounds write via TSIG record processing

A flaw was found in glibc, the GNU C Library. Specifically, deprecated functions responsible for printing TSIG Transaction Signature records fail to properly manage memory buffers. This oversight can lead to an out-of-bounds write when processing specially crafted TSIG records. An attacker could...

CVE-2026-54060 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, tensorflow-gpu-jupyter, mlflow, superset, openstack-horizon-2025.2-fips, open-webui, text-generation-inference, openstack-horizon-2025.2...

CVE-2026-59200 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, tensorflow-gpu-jupyter, mlflow, superset, openstack-horizon-2025.2-fips, open-webui, text-generation-inference, openstack-horizon-2025.2...

CVE-2026-59199 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, tensorflow-gpu-jupyter, mlflow, superset, openstack-horizon-2025.2-fips, open-webui, text-generation-inference, openstack-horizon-2025.2...

GHSA-62P4-GMF7-7G93 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, tensorflow-gpu-jupyter, mlflow, superset, openstack-horizon-2025.2-fips, open-webui, text-generation-inference, openstack-horizon-2025.2...

CVE-2026-55798 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, tensorflow-gpu-jupyter, mlflow, superset, openstack-horizon-2025.2-fips, open-webui, text-generation-inference, openstack-horizon-2025.2...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the QUIC transport parameters extension handler during the processing of HelloRetryRequest messages. An attacker can cause increased memory consumption by repeatedly triggering...

PT-2026-63396

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers...

PT-2026-63414

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.16.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.16.8-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An attacker can craft...

PT-2026-63476

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Insufficient validation of externally sourced BSON Binary JSON data during aggregation pipeline processing on a standalone mongod instance can lead to memory corruption. This may result in...

The vulnerability of the XML analysis mechanism in security systems and the Nessus vulnerability assessment tool allows attackers to execute arbitrary SQL queries.

The vulnerability of the XML analysis mechanism of the security system and the Nessus vulnerability assessment tool is related to the lack of measures taken to protect the SQL query structure during the processing of the nessus file. Exploiting this vulnerability allows an attacker to execute...

AlmaLinux 10 : grafana (ALSA-2026:35827)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:35827 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

Important: java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fixes: JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance XBM...

PT-2026-63475

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

PT-2026-63468

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...