CVE-2026-71439

A flaw was found in Mermaid. Mermaid Radar Diagrams are susceptible to a denial of service vulnerability. A remote attacker could exploit this by providing excessively large values for the 'ticks' parameter. This can lead to high CPU usage, causing the rendering webpage or JavaScript process to...

Security Bulletin:Vulnerability in bind affects IBM Netezza Appliance

Summary The bind package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVEs CVE-2026-1519, CVE-2025-40778 Vulnerability Details CVEID:CVE-2026-1519 DESCRIPTION: If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, th...

Security Bulletin: Immutable.js Denial of Service Vulnerabilities in Content Cortex for Microsoft Office

Summary Immutable.js versions before 4.3.9 and 5.1.8 have two DoS vulnerabilities CVSS 7.5, High. CVE-2026-59879 is an integer overflow in List operations set, setSize, setIn, updateIn that can cause infinite loops or unbounded memory allocation when given index/size values between 2^30 and 2^31...

Security Bulletin:Vulnerability in NGINX affects IBM Netezza Appliance

Summary The NGINX package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-9256 Vulnerability Details CVEID:CVE-2026-9256 DESCRIPTION: NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttprewritemodule module. This vulnerability exis...

CVE-2026-64654

A flaw was found in GitHub CLI gh. Multiple commands within the tool fail to neutralize terminal escape sequences when displaying externally controlled content. An attacker who can influence this content can embed malicious escape sequences. These sequences are then interpreted by a user's...

CVE-2026-44630

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-64653

A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...

Security Bulletin:Vulnerability in Glib2 affects IBM Netezza Appliance

Summary The Glib2 package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2025-14087 Vulnerability Details CVEID:CVE-2025-14087 DESCRIPTION: A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leadi...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

Oracle Linux 9 : ruby:3.3 (ELSA-2026-50828)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50828 advisory. ruby 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 rubygem-mysql2 0.5.5-3 - Disable tests on the 32bit platforms ix86...

Oracle Linux 8 : ruby:3.3 (ELSA-2026-50728)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50728 advisory. ruby 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-170929 Resolves: RHEL-193664 rubygem-abrt rubygem-mysql2 rubygem-pg Tenable has extracted the...

Oracle Linux 9 : ruby:4.0 (ELSA-2026-50827)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50827 advisory. ruby 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 rubygem-mysql2 0.5.7-1 - Upgrade to mysql2 0.5.7. Related:...

[SECURITY] [DSA 6424-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6424-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 09, 2026 https://www.debian.org/security/faq -...

CVE-2026-19359

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...

CVE-2026-19359

The CVE affects nxp-auto-goldvip gvip up to 1.4.0, specifically the SitewiseCustomFunction in the Lambda Function Handler. The issue enables improper access controls and can be exploited remotely. A fix is available in version 1.15.0; upgrading the affected component is advised. The accompanying ...

CVE-2026-19359

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...

EUVD-2026-54930

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...

CVE-2026-19359 nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...

EUVD-2026-54919

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

EUVD-2026-54886

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access...