Latest advisories

Anki's local HTTP server does not sufficiently validate requests

2026-06-20 GHSA-869J-R97X-HX2G

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

2026-06-20 GHSA-F4XH-W4CJ-QXQ8

Lokka: Azure Resource Manager URL path validation issue

2026-06-20 GHSA-G2GW-Q38M-VJFC

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

2026-06-20 GHSA-4XGF-CPJX-PC3J

Security Bulletin: Multiple Security Vulnerabilities in third-Party libraries used by IBM Tivoli Netcool Configuration Manager

2026-06-20 CVE-2026-5598

criticalIBM 2026-W25

SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter

2026-06-20 GHSA-CC8F-FCX3-GPJR

SurrealDB: Denial of Service via deep operator chains

2026-06-20 GHSA-JV2J-MQMW-XVV5

SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

2026-06-20 GHSA-HV6H-HC26-Q48P

SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

2026-06-20 GHSA-H4H3-3RFJ-X6FQ

SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch

2026-06-20 GHSA-H5RG-8P7F-47G2

Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

2026-06-19 CISCO-SA-ISE-MULTI-G5WP8VV

mediumCisco Cisco 2026-W25

Drupal Core: Mehrere Schwachstellen

2026-06-19 WID-SEC-2026-2002

criticalBSI 2026-W25

Gogs: Mehrere Schwachstellen

2026-06-19 WID-SEC-2026-2013

criticalBSI 2026-W25

kernel security update

2026-06-19 RHSA-2026:27355

kernel security, bug fix, and enhancement update

2026-06-19 RHSA-2026:27353

kernel-rt security, bug fix, and enhancement update

2026-06-19 RHSA-2026:27354

Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen

2026-06-19 WID-SEC-2026-1959

highBSI 2026-W25

NCSC-2026-0198 Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

2026-06-19 NCSC-2026-0198

highNCSC-NL NCSC-NL 2026-W25

NCSC-2026-0208 Kwetsbaarheden verholpen in Cisco Identity Services Engine

2026-06-19 NCSC-2026-0208

highNCSC-NL NCSC-NL 2026-W25

Red Hat Hardened Images RPMs bug fix and enhancement update

2026-06-19 RHSA-2026:26638

Red Hat Hardened Images RPMs bug fix and enhancement update

2026-06-19 RHSA-2026:26994

Red Hat Hardened Images RPMs bug fix and enhancement update

2026-06-19 RHSA-2026:27171

lowRed Hat Red Hat 2026-W25

Red Hat Hardened Images RPMs bug fix and enhancement update

2026-06-19 RHSA-2026:7655

Security Bulletin: A vulnerability in com.google.code.gson:gson may affect IBM Engineering Workflow Management (CVE-2022-25647)

2026-06-19 CVE-2022-25647

highIBM 2026-W25

Security Bulletin: Due to the use of zlib, IBM EntireX is vulnerable to Improper Validation of Specified Quantity in Input vulnerabilities (CVE-2026-3381, CVE-2026-27171).

2026-06-19 CVE-2026-3381

criticalIBM 2026-W25

Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to the use of Bouncy Castle library (CVE-2023-33202, CVE-2025-8916, CVE-2026-5588, CVE-2025-14813, CVE-2026-5598, CVE-2026-0636)

2026-06-19 CVE-2023-33202

criticalIBM 2026-W25

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a HTTP Request Smullging Vulnerability in Netty (CVE-2026-33870)

2026-06-19 CVE-2026-33870

highIBM 2026-W25

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a HTTP Request/Response Smuggling Vulnerability in Eclipse Jetty (CVE-2026-2332)

2026-06-19 CVE-2026-2332

criticalIBM 2026-W25

Security Bulletin: IBM DevOps Deploy / UrbanCode Deploy (UCD) is affected by a HTTP Request/Response Smuggling vulnerablity in Apache Tomcat (CVE-2026-24880)

2026-06-19 CVE-2026-24880

highIBM 2026-W25

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities bootstrap-3.4.1.tgz observed

2026-06-19 CVE-2024-6484

mediumIBM 2026-W25

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed

2026-06-19 CVE-2024-51454

mediumIBM 2026-W25

Security Bulletin: IBM Operational Decision Manager - Multiple CVEs addressed related to SOLR and its dependencies (such as Jetty) affecting ODM-9.0.0 and older versions

2026-06-19 CVE-2026-5795

criticalIBM 2026-W25

Security Bulletin: IBM Verify Identity Protection Self-Hosted is affected by multiple vulnerabilities

2026-06-19 CVE-2025-14920

highIBM 2026-W25

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

2026-06-19 CVE-2022-30187

criticalIBM 2026-W25

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

2026-06-19 CVE-2026-41680

criticalIBM 2026-W25

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

2026-06-19 CVE-2026-34268

highIBM 2026-W25

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

2026-06-19 CVE-2026-34268

highIBM 2026-W25

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

2026-06-19 CVE-2026-39821

criticalIBM 2026-W25

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

2026-06-19 CVE-2026-1225

criticalIBM 2026-W25

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

2026-06-19 CVE-2021-43784

highIBM 2026-W25

Squid: Mehrere Schwachstellen

2026-06-19 WID-SEC-2026-1920

mediumBSI 2026-W25

Webmin: Mehrere Schwachstellen

2026-06-19 WID-SEC-2026-2014

highBSI 2026-W25

@acastellon/auth: Authentication bypass via spoofable headers in validateToken()

2026-06-18 GHSA-GFJ5-979R-92PW

criticalGitHub GitHub 2026-W25

Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen

2026-06-18 WID-SEC-2026-1955

highBSI 2026-W25

budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

2026-06-18 GHSA-QQF5-X7MJ-V43P

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

2026-06-18 GHSA-2JQ4-Q6VV-4CP3

criticalGitHub GitHub 2026-W25

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

2026-06-18 GHSA-R253-R9JW-QG44

criticalGitHub GitHub 2026-W25

Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)

2026-06-18 GHSA-WM69-2PC3-RMMF

ffmpeg: Schwachstelle ermöglicht Denial of Service

2026-06-18 WID-SEC-2026-2015

mediumBSI 2026-W25

gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

2026-06-18 CVE-2026-0755

criticalGitHub GitHub 2026-W25

Linux Kernel: Mehrere Schwachstellen

2026-06-18 WID-SEC-2026-0809

mediumBSI 2026-W25

Linux Kernel: Mehrere Schwachstellen

2026-06-18 WID-SEC-2026-1088

mediumBSI 2026-W25

Linux Kernel: Mehrere Schwachstellen

2026-06-18 WID-SEC-2026-1252

mediumBSI 2026-W25

Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff

2026-06-18 WID-SEC-2026-1265

mediumBSI 2026-W25

OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

2026-06-18 CVE-2026-53854

OpenShift Container Platform 4.16.64 bug fix and security update

2026-06-18 RHSA-2026:25044

OpenShift Container Platform 4.16.64 packages and security update

2026-06-18 RHSA-2026:25043

PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

2026-06-18 GHSA-6VVH-PXR4-25R7

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

2026-06-18 GHSA-JC38-X7X8-2XC8