CVE-2026-25244

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

EUVD-2026-30805

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

CVE-2026-25244

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (5.6.5), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.6.0, <=5.6.5) +53 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.5.7)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin 5.6.5 -...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=5.7.7, <=5.7.9), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.7.0, <=5.7.9) +60 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.6.27)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.6.27 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =5.7.7, =5.7.0, =5.7.7, =5.7.0, =5.7.0...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (5.6.5), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (5.6.5) +57 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.5.7)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin 5.6.5 -...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (6.8.0), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (>=6.6.0, <=7.4.5) +197 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (>=6.0.0, <=6.9.5)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: OSV:GHSA-3653-68V6-RQ57...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (5.6.5), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.6.0, <=5.6.5) +38 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.5.7)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin 5.6.5 -...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=6.0.3, <=6.1.3), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.1.3) +67 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.6.36)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.6.36 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =6.0.3, =6.0.0,...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=6.4.2, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.2, <=6.4.7) +74 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =6.4.2, =6.4.2,...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (6.8.0), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0) +185 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (>=6.0.0, <=6.9.5)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.10.0 - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-uhnfhirtest 6.8.0 and more Source cves: CVE-2026-45367 Source advisory:...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +155 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.0.0, <=6.9.4.1)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =6.8.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-16757892...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=6.2.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.2.0, <=6.2.5) +85 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.68)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.68 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =6.2.0, =6.2.0, =6.2.0, =6.2.0,...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (6.4.1), ca.uhn.hapi.fhir:hapi-fhir-cli-api (6.4.1) +33 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.97)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.97 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin 6.4.1 -...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (6.4.0), ca.uhn.hapi.fhir:hapi-fhir-cli-api (6.4.0) +30 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.881)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.881 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin 6.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=5.7.7, <=5.7.9), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (>=5.7.7, <=5.7.9) +61 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (5.6.27)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version 5.6.27 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =5.7.7, =5.7.7, =5.7.7, =5.7.0,...

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

Summary In a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that: - Sends an HTTP POST to the supplied URL with attacker-controlle...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of netty-handler-proxy

Summary Due to use of netty-handler-proxy, DevOps Test Performance and Rational Performance Tester contain a potential header injection vulnerability. Vulnerability Details CVEID:CVE-2026-42578 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina...

Security update for perl-Crypt-URandom

This update for perl-Crypt-URandom fixes the following issue: CVE-2026-2474: negative length parameter in the XS function can lead to a heap-based buffer overflow bsc1258266. Changes for perl-Crypt-URandom: updated to 0.550.0 0.55 Fix for sysread/read failures. Thanks to Miha Purg for GH20 Fix fo...