Security Bulletin: Multiple vulnerabilities in IBM Java SDK (August 2026) affect IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK security updates in August 2026. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION:...

CVE-2026-90924: Use of Default Credentials

Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117...

CVE-2026-80357: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

PT-2026-99901

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

PT-2026-99985

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

PT-2026-99937

Name of the Vulnerable Software and Affected Versions @xhmikosr/decompress versions prior to 10.2.2 @xhmikosr/decompress versions prior to 11.1.4 decompress versions prior to 4.2.2 Description The default decompressinput, output API uses lexical containment checks that fail to account for the...

PT-2026-99790

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description An authenticated user can read, modify, or delete weblog content belonging to other weblogs. This occurs because the handlers for the legacy XML-RPC Blogger and MetaWeblog APIs authenticate the caller bu...

CVE-2026-80358: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

ipa security, bug fix, and enhancement update

4.13.4-1.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 - Add bind to ipa-server-common Requires Orabug: 36518596 4.13.4-1 - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval reachable before authorization check allows environment disclosure and denial of...

PT-2026-99905

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 Description The Git webhook receiver the gitjob webhook service fails to verify incoming requests when a webhook secret is not configured. This allows a remote caller with network access to the...

PT-2026-102332

Name of the Vulnerable Software and Affected Versions Eleveo Quality Management version 9.7.0 Description A path traversal issue exists in the Questionnaire Audio Upload component within the Scorecard.jsp file. This flaw allows a remote attacker to manipulate file paths to access unauthorized...

PT-2026-99911

Name of the Vulnerable Software and Affected Versions Dell Boot Optimized Server Storage BOSS versions prior to 2.2.13.2038 Description The SMCU on 17G BOSS-N1 controllers contains an On-Chip Debug and Test Interface with improper access control. An unauthenticated attacker with physical access t...

PT-2026-102338

Name of the Vulnerable Software and Affected Versions LiteLLM affected versions not specified Description A weak authentication issue exists in the JWT authentication flow. An attacker with a valid JSON Web Token JWT from the configured identity provider can authenticate as any existing user by...

MMSkillRisk: Can Agents Stay Safe When Multimodal Skills Become Traps?

Agent skills are shareable packages of procedural instructions, tools, and examples. Multimodal skills additionally include visual references that agents retrieve and inspect during execution. Because these images guide actions, attackers can disguise malicious instructions as ordinary visual...

RHEL 10 : ipa (RHSA-2026:72279)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72279 advisory. Red Hat Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and...

PT-2026-99902

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

Totolink A8000R Router setLanguageCfg XSS

The vulnerability of the setLanguageCfg /cgi-bin/cstecgi.cgi function in the Totolink A8000R router’s microprogramming software is related to the lack of authentication for the critical langType parameter during processing. Exploiting this vulnerability allows an attacker to bypass security...

HPESBNW05146 rev.1 - Multiple Vulnerabilities in HPE Unified OSS Console (UOC) and HPE Unified OSS Console Assurance Monitoring (UOCAM)

Potential Security Impact: Local: Cross-Site Request Forgery CSRF; Remote: Denial of Service DoS, Disclosure of Privileged Information, Gain Unauthorized Access, Unauthorized Privileged Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC UOC Version...

CVE-2026-101044

A flaw was found in pnpm. The package manager does not properly sanitize dependency names and alias paths specified within project lockfiles. By convincing a user or build system to install a project containing a crafted lockfile, an attacker can exploit this path traversal issue to create...

Improper Authentication

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authentication via the password login flow in UsersRouter.js when a code-based auth adapter is in use. An attacker...