Bundesamt für Sicherheit in der Informationstechnik vulnerabilities and threats

Multiple vulnerabilities have been identified in Apache Wicket, a Java-based component web framework. These issues affect versions prior to and including 10.9.0. A fix has been released in version 10.9.0.

Multiple vulnerabilities have been identified in Zabbix, an open-source network monitoring system. These issues affect versions prior to 6.0.45. A fix addressing these vulnerabilities is available in version 6.0.45.

A vulnerability in Palo Alto Networks PAN-OS allows execution of arbitrary code with administrator privileges. The affected versions include all versions prior to 12.1.4-h5 and version 12.1.4-h5 itself. The issue has been fixed in version 12.1.4-h5.

Multiple vulnerabilities in Dell BIOS firmware versions prior to and including 2.14.1 can lead to denial of service conditions. The BIOS is the firmware used in IBM PC compatible computers manufactured by Dell Inc. A fix for these vulnerabilities is available in version 2.14.1.

CVE-2026-7482 is a vulnerability in Ollama, an open-source runtime for locally running Large Language Models (LLMs). The flaw allows information disclosure. A fix for this vulnerability is available in version 0.17.1.

Multiple vulnerabilities have been identified in Rapid7 Velociraptor, an endpoint detection and response (EDR) and digital forensics tool. These vulnerabilities affect versions prior to 0.76.5. A fix is available in version 0.76.5.

A security vulnerability identified as CVE-2026-34085 affects the fontconfig RPM packages in Red Hat Hardened Images. The flaw could allow code execution or denial of service (DoS). Red Hat has released an update to address this issue in fontconfig version 2.17.1-0.1.hum1 for multiple architectures.

Redis ist ein In-Memory-Datenstrukturspeicher, der als Datenbank, Cache und Message Broker verwendet wird.

A vulnerability in the Google Android operating system allows execution of arbitrary code with administrator privileges. The issue affects versions prior to and including 2026-05-01. A fix is available in version 2026-05-01.

Meta WhatsApp, a widely used messaging application, has multiple vulnerabilities reported. The details about the specific flaws, affected versions, and impact are not provided in the available data.

A vulnerability identified as CVE-2025-47408 affects Dell products, potentially allowing code execution. The information is limited, with no details on affected versions, CVSS score, or exploitation status.

A vulnerability identified as CVE-2026-29514 affects NetBox, an open source solution for modeling and documenting modern networks. The vulnerability reportedly allows code execution. No specific affected versions or CVSS score are provided, and no known exploits in the wild have been reported.

A vulnerability identified as CVE-2025-66369 affects Samsung Exynos mobile chipsets and processors. The flaw enables a denial of service condition. No specific affected versions or detailed technical information are provided. There is no indication of known exploitation in the wild or available patches.

A compromised package in Bitwarden CLI (npm) version 2026.4.0 allows theft of login credentials and data exfiltration. Bitwarden is an open-source password management solution. The vulnerability was published on May 3, 2026. No CVSS score or detailed technical information is provided. There is no indication of known exploits in the wild or available patches.

A vulnerability in Dell PowerEdge servers allows for data manipulation and denial of service. The issue affects versions prior to and including 20.26.03.25. A fix is available in version 20.26.03.25.

A vulnerability identified as CVE-2026-7554 affects D-LINK routers, which are typically used by private users and small businesses. The flaw allows an attacker to gain administrator rights on the affected devices. No specific affected versions or detailed technical information are provided.

Multiple vulnerabilities have been identified in IBM LangChain Desktop version 1.9.0, a local application used for developing and running LangChain-based applications. The specific nature and impact of these vulnerabilities are not detailed in the available information.

Langflow, an open-source visual interface for building LLM-based applications, has multiple vulnerabilities that allow code execution. These flaws affect versions prior to and including 1.8.4. A fix is available in version 1.8.4.

Multiple vulnerabilities have been identified in Progress Software MOVEit Automation, a managed file transfer solution that provides transparency and control over file transfer activities. Specific details about the vulnerabilities, affected versions, and impact are not provided in the available information.

A vulnerability identified as CVE-2026-2311 affects IBM i, an operating system for IBM Power Systems servers designed for business applications. The vulnerability enables privilege escalation, potentially allowing an attacker to gain elevated permissions. No specific affected versions or CVSS score are provided, and no known exploits are reported in the wild.