Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : OpenJDK 8 vulnerabilities (USN-9009-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-9009-1 advisory. It was discovered that the Security...

USN-9005-1 openjdk-27 vulnerabilities

It was discovered that the 2D component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. CVE-2026-91415 It was discovered that the Networking component of OpenJDK 27 did not...

USN-9004-1 openjdk-25 vulnerabilities

It was discovered that the 2D component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. CVE-2026-91415 It was discovered that the Networking component of OpenJDK 25 did not...

USN-9004-1: OpenJDK 25 vulnerabilities

It was discovered that the 2D component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. CVE-2026-91415 It was discovered that the Networking component of OpenJDK 25 did not...

CVE-2026-19131

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization...

CVE-2026-19131

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to multiple vulnerabilities where low-privileged users can query arbitrary indices. This issue stems from missing authorization , potentially allowing attackers to read sensitive data . No specific exploit information or remediati...

CLEANSTART-2024-RU95506 Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories

Security vulnerability affects the librewolf package. Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories...

CLEANSTART-2024-DG28771 Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories

Security vulnerability affects the firefox package. Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories...

EUVD-2026-90370

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service...

CVE-2026-102098 Kiteworks Core SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service...

CVE-2026-102098 Kiteworks Core SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service...

PT-2026-103536

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A stored SQL injection exists within an administrative reporting feature. This issue allows an authenticated administrator to read sensitive data from the underlying database and potentially...

PT-2026-85199

Name of the Vulnerable Software and Affected Versions Pillow affected versions not specified Description Improper memory management occurs when processing certain image files, which could allow an attacker to cause a denial of service or read sensitive data. Recommendations At the moment, there i...

PT-2026-67943

Name of the Vulnerable Software and Affected Versions VikAppointments Service Booking Calendar affected versions not specified Description An unauthenticated SQL injection exists because a parameter controlling the sorting of the public reviews list is used to construct a database query without...

CVE-2026-64351

A flaw was found in the Linux kernel's USB Kalmia driver. An attacker with a specially crafted USB device could exploit an out-of-bounds read vulnerability in the kalmiarxfixup function. This occurs due to an incorrect calculation of the USB packet length when processing short bulk-IN frames,...

CVE-2026-3482 IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request...

CVE-2026-62387

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: as its default CORS configuration on all responses, including authenticated endpoints and preflight OPTIONS responses. Because the plugin accepts credentials via the Authorization and X-API-Token...

Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

Summary All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's readbasicdata permission granted to Space Auditors and similar low-trust roles. Sensitive actuators including heap dump, environment, and thread dump do not raise this to...

PT-2026-55342

Summary All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's read basic data permission granted to Space Auditors and similar low-trust roles. Sensitive actuators including heap dump, environment, and thread dump do not raise this to...

PYSEC-2026-2144

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS...