Security Bulletin: The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Information Disclosure (CVE-2025-36348)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the information disclosure vulnerability Vulnerability Details CVEID:CVE-2025-36348 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway could allow a remote privileged attacker to obtain sensitive...

Amazon Linux 2023 : fontforge, fontforge-devel (ALAS2023-2026-1378)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1378 advisory. FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-1405)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1405 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processe...

Fedora 43 : phpunit10 (2026-ff411cd463)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ff411cd463 advisory. Version 10.5.63 - 2026-01-27 Fixed Regression introduced in PHPUnit 9.6.33 ---- Version 10.5.62 - 2026-01-27 Changed To prevent Poisoned Pipeline Execution P...

Fedora 42 : python-jupytext (2026-d3c5092654)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d3c5092654 advisory. See https://github.com/mwouts/jupytext/blob/main/CHANGELOG.md for changes in versions 1.19.0 and 1.19.1. This update contains a fix for CVE-2025-13465. Tenab...

Fedora 43 : openttd (2026-dd8314c4f3)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dd8314c4f3 advisory. 15.x 15.1 2026-01-24 - Fix 15088: When building a new train, the refit button state may be incorrect 15162 - Fix 15160: Incorrect company names displayed in...

USN-8001-1: OpenJDK 11 vulnerabilities

It was discovered that the RMI component of OpenJDK 11 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. CVE-2026-21925 Mingijung...

GHSA-R267-H4HP-P29F vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure, linux-aws, linux-vmware, linux-qemu...

EulerOS Virtualization 2.10.1 : python-jinja2 (EulerOS-SA-2026-1142)

According to the versions of the python-jinja2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with...

RHEL 10 : curl (RHSA-2026:1477)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:1477 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP,...

Oracle Linux 8 : php:8.2 (ELSA-2026-1412)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1412 advisory. libzip 1.7.3-1 - update to 1.7.3 1.6.1-1 - update to 1.6.1 - enable lzma support 1.5.2-1 - update to 1.5.2 - add all explicit cmake options to ensure...

GHSA-R8F4-MX7H-29JP vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow when parsing a CMS AuthEnvelopedData message. An attacker can trigger a crash by supplying AEAD ciphers such as AES-GCM with malicious initialization vectors. These are encoded in the ASN.1 parameters and...

GHSA-793V-589G-574V

creationtimestamp| type| source ---|---|--- 2026-01-24 21:30:26+00:00| seen| https://gist.github.com/alon710/1a8cdfc9ee48e8684ff81a0e3d627083...

Security update for log4j

This update for log4j fixes the following issues: Security fixes: CVE-2025-68161: Fixed absent TLS hostname verification that may allow a man-in-the-middle attack bsc1255427 Other fixes: Upgrade to 2.18.0 Added Add support for Jakarta Mail API in the SMTP appender. Add support for custom Log4j 1....

CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2025-13699)

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-13699 advisory. - MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This...

Azure Linux 3.0 Security Update: kernel (CVE-2024-45010)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45010 advisory. - In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only mark 'subflow' endp as...

Azure Linux 3.0 Security Update: kernel (CVE-2024-49989)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49989 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix double free issue...

RHEL 9 : glib2 (RHSA-2026:0936)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0936 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the...

CVE-2026-0895 Insecure Deserialization in extension "Mailqueue" (mailqueue)

The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core...