Security Bulletin: Multiple vulnerabilities in IBM Semeru affects IBM® Db2® (April 2026 CPU)

Summary There are vulnerabilities in IBM Runtime Environment Java™ Version 8.0.8.60 and earlier, and IBM Semeru Version 21.0.10.0 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in April 2026 Vulnerability Details CVEID:CVE-2026-22021 DESCRIPTION:...

WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin If-So Dynamic Content Personalization versions = 1.10...

OESA-2026-3275 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A security vulnerability exists in QEMU, the details of which have not been fully disclosed.CVE-2026-15578 CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has be...

[slackware-security] libXfont2

New libXfont2 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libXfont2-2.0.9-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Font Server Client encoding Out-Of-Bounds...

EUVD-2026-54170

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

Moderate: Red Hat Security Advisory: systemd security, bug fix, and enhancement update

An update for systemd is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

GHSA-2QF8-W85F-8MMV vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-17685 vulnerabilities

Vulnerabilities for packages: chromium...

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...

GHSA-P6V2-JMFG-M6R4 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-17909 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-71238

creationtimestamp| type| source ---|---|--- 2026-08-05 11:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgn2laot2o...

DEBIAN-CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in July 2026. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provid...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

katello: missing repository authorization in content_uploads exposes cross-product content existence

A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the editproducts permission to query content information for repositories outside the products they were authorized to...

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CLSA-2026-1782262678 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.2-tuxcare.1...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

OnionShare Receive mode writes uploaded files even when file uploads are disabled

SummaryOnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still send...