Security Bulletin: Db2 Query Management Facility is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2026 - Includes OpenJDK April 2026 CPU plus CVE-2026-6918

Summary Db2 Query Management Facility is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2026 - Includes OpenJDK April 2026 CPU plus CVE-2026-6918 Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via...

MAL-2026-5901 Malicious code in chai-as-polished (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2ea0d46e0bb4382e8d684d025cb72b7f99e37874c571e9946ae1268b70be6cf Package name is a one-edit typosquat of the widely-used chai-as-promised, but the shipped code is unrelated to chai. The exported middleware spawns a...

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

Executive Summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Formats.Tar. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A tampering vulnerability exists in the...

BIT-MONGODB-2026-9747 Crafted cross-shard merge aggregation crashes MongoDB Server

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module path-to-regexp

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Discovery Connectors are vulnerable to multiple vulnerabilities due to Node.js module path-to-regexp. Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time you have...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.1 security and extras update

Red Hat OpenShift Container Platform release 4.22.1 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

PT-2026-50012

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 Description An issue exists in the Web Runtime Security component of JD Edwards EnterpriseOne Tools. An unauthenticated attacker with network access via HTTP can exploit this fla...

Code-Augur: Agentic Vulnerability Detection Via Specification Inference

The advent of agentic vulnerability detection is already becoming a watershed moment for software security. Audits conducted entirely by autonomous LLM agents are uncovering critical vulnerabilities in fundamental software underpinning digital society. Many of these vulnerabilities remained maske...

CVE-2026-0133: Undefined Security Weakness

In smmuattachdev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-49792

In smmu attach dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-49955

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Portal version 12.2.1.4.0 Oracle WebCenter Portal version 14.1.2.0.0 Description An issue exists in the Runtime Tools component of Oracle WebCenter Portal. A low privileged attacker with network access via HTTPS can exploit th...

PT-2026-50019

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 Description An issue exists in the Web Runtime Security component of JD Edwards EnterpriseOne Tools. An unauthenticated attacker with network access via HTTP can compromise the...

EUVD-2025-210156

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parseoption src/if-options.c:1886, the code performs a member access on a NULL pointer of type 'struct dhcpopt' when an unexpected/invalid option token or parsing state caus...

UBUNTU-CVE-2026-47261

Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 pathopen interfaces by...

assistant-stream (0.0.1), mirapi (>=0.0.1.dev0, <=0.0.3) +4 more potentially affected by CVE-2026-54282 via starlette (0.39.2)

starlette PYPI version 0.39.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - assistant-stream 0.0.1 - mirapi =0.0.1.dev0, =0.0.3 - nlip 0.1.0 - pyonir 0.0.4 - scout-runtime 0.1.0 - starlette-authlib 0.3.2 Source cves:...

360solutions-bc-mcp (>=0.5.3, <=0.5.6), agent-pbx (>=2.1.0, <=2.2.0) +67 more potentially affected by CVE-2026-54282 via starlette (>=1.0.0rc1, <=1.2.1)

starlette PYPI version =1.0.0rc1, =0.5.3, =2.1.0, =1.1.0, =1.3.3, =0.17.0b2, =0.1.0, =7.2.0, =0.21.0, =1.1.0, =1.5.0, =1.9.13, =0.1.3a0, =1.0.0, =0.7.13, =0.7.21 and more Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2026-49853 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2026-49853 Source advisory: OSV:GHSA-3X9G-8VMP-WQVF...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2026-49855 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2026-49855 Source advisory: OSV:GHSA-MGF9-4VPG-HJ56...

assistant-stream (0.0.1), mirapi (>=0.0.1.dev0, <=0.0.3) +4 more potentially affected by CVE-2026-48818 via starlette (0.39.2)

starlette PYPI version 0.39.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - assistant-stream 0.0.1 - mirapi =0.0.1.dev0, =0.0.3 - nlip 0.1.0 - pyonir 0.0.4 - scout-runtime 0.1.0 - starlette-authlib 0.3.2 Source cves:...

agentbuddy (0.1.1.dev33), agentic-security (>=0.1.8, <=0.2.0) +206 more potentially affected by CVE-2026-48818 via starlette (0.38.6)

starlette PYPI version 0.38.6 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agentbuddy 0.1.1.dev33 - agentic-security =0.1.8, =0.0.3.155844, =0.1.0rc2, =0.1.0rc1, =0.7.5.8, =1.0.1, =5.0.0, =0.1.4, =0.1.5 and more Sour...