Threat database

Red Hat has released a security update for multiple krb5-related packages in Red Hat Hardened Images RPMs addressing bugs and enhancements. The update references CVE-2026-107708 and CVE-2026-107778 but does not provide detailed vulnerability descriptions or specific impact information. The update is available for aarch64, s390x, and x86_64 architectures. A patch is available to remediate the issues.

ImageMagick versions prior to 6.9.13-58 and 7.x before 7.1.2-33 contain a vulnerability in the IsRightsAuthorizedByName security policy check. This flaw allows local attackers with the ability to create symbolic links to bypass configured policy restrictions by redirecting the symlink to a restricted path. The vulnerability is rated as low severity with limited impact on confidentiality and integrity, and no impact on availability. A patch is available to address this issue.

CVE-2026-108941 is a low-severity code injection vulnerability in Linketic CityGaussian version 2.0. It affects the parse_cfg_args function in the internal/utils/common.py file within the Sidecar Parsing component. The vulnerability arises from manipulation of the cfg_args argument, allowing code injection. Exploitation requires local access and user interaction. No patch or vendor response has been reported yet.

CVE-2026-108940 is a path traversal vulnerability in EricLBuehler Mistral.rs affecting versions 0.9.0 through 0.9.3. The flaw exists in the calibration_apply function within mistralrs-server-core/src/handlers.rs, where manipulation of the save_cimatrix argument allows remote attackers to perform path traversal. This vulnerability has a CVSS 4.0 score of 6.9 (medium severity). The issue is fixed in version 0.9.4.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a critical vulnerability (CVE-2026-96119) in the HTTP Server Administration web application. This flaw involves improper data sanitization that could allow a remote authenticated attacker to execute arbitrary code or obtain sensitive information on the affected system. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code, also known as Code Injection).

CVE-2026-19938 is a use-after-free vulnerability in the Zephyr Bluetooth host ATT transmit path. It occurs when the ATT Signed Write Command fails signing due to missing local CSRK keys, causing a buffer to be freed incorrectly and later reused. This leads to host-side memory corruption, including list corruption, double frees, and out-of-bounds writes, typically resulting in crashes or assertion failures. The vulnerability requires the deprecated CONFIG_BT_SIGNING to be enabled and an application issuing signed writes. It affects Zephyr versions from 2.3.0 up to but not including 4.5.0.

CVE-2026-19937 is a denial of service vulnerability in the Zephyr Bluetooth Mesh Access layer affecting versions 3.6.0 through 4.4.2. It involves a resource leak in the delayable-message context pool when handling segmented messages under certain conditions, causing the device to silently drop replies and become unresponsive until rebooted. There is no memory corruption or data integrity impact.

CVE-2026-19936 is a race condition vulnerability in the Zephyr Bluetooth Mesh Access-layer delayable message queue. It arises from unsynchronized access to shared lists and a delayable work item between two cooperative threads, leading to potential null pointer dereferences and duplicated message transmissions. The vulnerability can cause the system workqueue thread to abort or the node to reset, resulting in loss of availability. It does not allow memory corruption or code execution. A fix is available that serializes list mutations with a spinlock and removes unsafe list operations.

CVE-2026-108939 is a server-side request forgery (SSRF) vulnerability in EricLBuehler mistral.rs versions 0.9.0 through 0.9.3. The flaw exists in the is_global_ip function within the mistralrs-server-core/src/media_source.rs file, where manipulation of the ip argument can lead to SSRF. This vulnerability can be exploited remotely. A patch fixing this issue is available in version 0.9.4.

CVE-2026-108938 is a medium severity vulnerability in code-projects Matrimonial System version 1.0. It allows remote attackers to access files or directories due to improper handling of the file db/matrimony.sql. Exploit code has been published, but no official patch or remediation details are available.

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.