CVE-2026-49326

CVE-2026-49326 affects Apache HBase thrift and REST delegation service. The vulnerability stems from missing owner/authorization checks in fetch and close steps of the scanner delegation flow, enabling a user to fetch rows from a scanner opened by another user and to close scanners that belong to...

OESA-2026-3142 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Handling of URL Encodi...

PT-2026-64315

Name of the Vulnerable Software and Affected Versions Image::WebP versions prior to 0.3.0 Description Image::WebP bundles a copy of libwebp version 0.3.0 instead of linking to the system library. This bundled version contains multiple known security flaws. The issue occurs when the module decodes...

postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...

CVE-2026-11721

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

CLEANSTART-2026-PF56679 Security fixes for CVE-2025-61727, CVE-2025-61729, CVE-2026-33186, CVE-2026-39883, ghsa-6v2p-p543-phr9, ghsa-f6x5-jh6r-wrfv, ghsa-hfvc-g4fc-pqhx, ghsa-j5w8-q4qc-rx2x, ghsa-mh2q-q3fh-2475, ghsa-p77j-4mvh-x3m3 applied in versions: 0.59.0-r0, 0.59.0-r1, 0.59.5-r0, 0.59.7-r0

Multiple security vulnerabilities affect the kapp-controller package. These issues are resolved in later releases. See references for individual vulnerability details...

MAL-2026-10721 Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

MAL-2026-10722 Malicious code in @whalent/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...

Malicious code in @whalent/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...

MAL-2026-10759 Malicious code in ryry-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts und...

PT-2026-60428

Name of the Vulnerable Software and Affected Versions VMware Avi Load Balancer versions 22.1.1 through 22.1.7 VMware Avi Load Balancer versions 30.1.1 through 30.2.6 VMware Avi Load Balancer versions 31.1.1 through 31.2.2 VMware Avi Load Balancer version 32.1.1 Description Flaws in file path...

Alibaba Cloud Linux 3 : 0206: tomcat (ALINUX3-SA-2026:0206)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0206 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-29146: Padding Oracle vulnerabili...

BIT-TOMCAT-2026-59084 Apache Tomcat: EncryptInterceptor requirements not clearly documented

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0 through 11.0.23, from 10.1.0 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38...

Security update for grafana (moderate)

openSUSE security update: security update for grafana ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21351-1 Rating: moderate References: bsc1262187 bsc1263272 Cross-References: CVE-2025-12141 CVE-2026-21725 CVE-2026-41607 CVSS scores: CVE-2025-121...

CVE-2026-59083

Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...

EUVD-2026-43638

Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...

CVE-2026-15477 Bahmni bahmnicore Search Endpoint sql additionalParams sql injection

A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component Search Endpoint. Performing a manipulation of the argument test results in sql injection. The attack can be initiated remotely...

OESA-2026-2892 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

K000162157: Apache Tomcat vulnerability CVE-2026-43513 and CVE-2026-43515

Security Advisory Description CVE-2026-43513 Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0....

PT-2026-56678

Name of the Vulnerable Software and Affected Versions DSpace versions 8.0-rc1 through 8.3 DSpace versions 9.0-rc1 through 9.2 DSpace versions 10-rc1 through 10.0-rc1 Description A path traversal issue exists in the COAR Notify / LDN service. An attacker with DSpace administrator credentials can...