Failed to connect to the worker service: "Alberta Standard Time" or "British Columbia Standard Time" was not recognized as a valid Windows time zone ID

Challenge After the Windows OS time zone of the Veeam Backup Server is changed to Alberta Standard Time, new and existing workers fail with the following error: Failed to connect to the worker service: "Alberta Standard Time" was not recognized as a valid Windows time zone ID Alternatively, after...

CVE-2025-59342

CVE-2025-59342 - Path Traversal esm-dev Author: Byte Reaper Description CVE-2025-59342 is a path traversal vulnerability in esm.sh, a nobuild content delivery network CDN for modern web development, in version 136 and earlier. The issue exists in the handling of the X-Zone-Id HTTP header, which i...

CLEANSTART-2026-VS09548 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component

Security vulnerability affects the ollama-fips package. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component...

PT-2026-122845

Security vulnerability affects the ollama-fips package. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component...

CLEANSTART-2026-QM27713 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component

Security vulnerability affects the ollama-fips package. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component...

CLEANSTART-2026-KC86970 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component

Security vulnerability affects the cri-tools package. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component...

CLEANSTART-2026-MQ17226 certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain

Security vulnerability affects the cri-tools package. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

A certificate with a URI that has an IPv6 address and a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not allowed in web PKIs; therefore, this only affects users of private PKIs that use URIs...

curl: 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface Summary When a proxy is configured with a literal link-local IPv6 address and an explicit zone ID e.g. http://fe80::1%25eth0:8080, curl parses and stores the zone correctly but never applies it to the socket...

TencentOS Server 4: git-lfs (TSSA-2026:0739)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0739 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 4: skopeo (TSSA-2026:0740)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0740 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

A flaw was found in the crypto/x509 package of the Golang standard library. A certificate with a URI, which has a IPv6 address with a zone ID, may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI; this...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: golang (UTSA-2026-016821)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016821 advisory. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to...

Unity Linux 20.1050e / 20.1070e Security Update: golang (UTSA-2026-017392)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017392 advisory. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates...

PT-2026-40983

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead...

curl: libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms

Summary: libcurl omits the IPv6 zoneid component from multiple security-sensitive host identity decisions even though the connection layer still routes by zoneid. As a result, two distinct scoped/link-local destinations such as fe80::X%zoneA and fe80::X%zoneB are treated as the same host by...

Security Bulletin: IBM Storage Protect Server is susceptible to a vulnerability due to Golang net library

Summary Golang net library is used by the IBM Storage Protect Server Object Agent and OSSM component. Golang net is vulnerable to IPv6 zone ID mishandling leading to proxy bypass, This bulletin identifies the steps to address the vulnerabilities. CVE-2025-22870. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a misinterpretation of Input in golang.org/x/net/proxy [CVE-2025-22870]

Summary IBM Watson Speech Services Cartridge is vulnerable to a misinterpretation of Input in golang.org/x/net/proxy, due to matching of hosts against proxy patterns which can improperly treat an IPv6 zone ID as a hostname component CVE-2025-22870. Golang is used in our speech utilities. This...

EUVD-2025-29764

Malicious code in bioql PyPI...

Security Bulletin: Multiple vulnerabilities in IBM Aspera HTTP Gateway

Summary Multiple vulnerabilities were addressed in IBM Aspera HTTP Gateway version 2.3.2. Vulnerability Details CVEID:CVE-2025-36274 DESCRIPTION: IBM Aspera HTTP Gateway stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. CWE:CWE-312...