CVE-2026-71560

CVE-2026-71560 describes an out-of-bounds heap read in the C++ deserializer of Apache Fory when deserializing structs containing tagged integer fields. Affected: Apache Fory C++ versions 0.14.0 up to, but not including, 1.5.0. Impact: potential information disclosure or denial of service via a cr...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.14.0 Vulnerability Details CVEID:CVE-2026-14620 DESCRIPTION: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and...

Security Bulletin: due to the use of Apache Log4j, IBM Transformation Extender Advanced is vulnerable to hostname verification bypass and log injection via CRLF sequences

Summary Apache Log4j is used by IBM Transformation Extender Advanced also known as IBM Standards Processing Engine as part of common utility helpers. Apache Log4j has been updated to address CVE-2026-34477 which causes hostname verification bypass and CVE-2026-34478 which causes log injection via...

OESA-2026-3311 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through...

OESA-2026-3310 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through...

EUVD-2026-54260

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mmsmapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be...

Slackware Linux 15.0 / current p11-kit Vulnerability (SSA:2026-218-02)

The version of p11-kit installed on the remote host is prior to 0.26.5. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-218-02 advisory. New p11-kit packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21532-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21532-1 advisory. This update for php8 fixes the following issues - Update to version 8.4.24 - CVE-2026-7260: Stack overflow in phar with circular symlinks...

Linux Distros Unpatched Vulnerability : CVE-2025-49506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking thei...

Linux Distros Unpatched Vulnerability : CVE-2026-32327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the...

Security Bulletin: IBM z/TPF Development is affected by multiple vulnerabilities

Summary Multiple vulnerabilities were identified in the open-source package axios which provides the HTTPS/HTTP client used by the IBM z/TPF Development extension. Fixes for these vulnerabilities were made available in axios version 1.18.0. Vulnerability Details CVEID:CVE-2026-67312 DESCRIPTION:...

CVE-2026-19111

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

[SECURITY] [DLA 4722-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4722-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 06, 2026 https://wiki.debian.org/LTS -...

Incomplete List of Disallowed Inputs

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the create function in non-sandboxed template contexts. An attacker can access arbitrary files on the server filesystem by instantiating SplFileObject...

Exposure of Resource to Wrong Sphere

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the elementId parameter, which allows interpolation of environment variables and secrets into a Twig template even when the Twig sandbox is enabled. A...

Incorrect Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Incorrect Authorization through the structures/move-element process. An attacker can alter the ordering and nesting of categories, affecting their URLs and potentially corrupting navigation o...

CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

jsoup: Cleaner may expose markup with custom raw-text elements

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup...

GHSA-PMHH-3W7G-XQP8 jsoup: Cleaner may expose markup with custom raw-text elements

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup...

Protection Mechanism Failure

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Protection Mechanism Failure through the SecurityPolicy process. An attacker can execute arbitrary code on the server by rendering a malicious Twig template after authenticating to the contro...