Bundesamt für Sicherheit in der Informationstechnik vulnerabilities and threats

A vulnerability in the Angular front-end web application framework allows information disclosure. Angular is a TypeScript-based framework and this issue affects versions prior to and including 22.0.0-next.8. The vulnerability has been fixed in version 22.0.0-next.8.

Multiple vulnerabilities have been identified in OpenClaw, a personal AI assistant designed to run on users' own devices. These issues affect versions prior to and including 2026.4.15. A fixed version, 2026.4.15, has been released by the Bundesamt für Sicherheit in der Informationstechnik.

Multiple security vulnerabilities have been identified affecting Red Hat Enterprise Linux and Red Hat Satellite, specifically involving the satellite/iop-remediations-rhel9 container image and related components. Red Hat Satellite is used for centralized management and update distribution in networks running Red Hat Enterprise Linux. The vulnerabilities are tracked under CVE-2026-30951 and CVE-2026-4800. Red Hat has released updated container images and advisories addressing these issues. No explicit fixes for the CVEs are detailed in the advisories, but updated images are generally available. There are no known exploits in the wild at this time. The vendor classifies these advisories as important but does not specify direct remediation steps beyond updating to the new container images. Patch status is not explicitly confirmed in the advisories, so users should consult Red Hat's official documentation and errata for current guidance.

A vulnerability in Podman HyperV Machine allows execution of arbitrary code with administrator privileges. Podman is a container runtime and management tool that enables users to run and manage containers without a separate daemon process. The vulnerability could lead to privilege escalation on affected systems.

A vulnerability in Apache NiFi allows for code execution. Apache NiFi is a data processing and distribution system that supports scalable directed graphs for data routing, transformation, and system mediation logic. The vulnerability affects versions before 2.9.0 and version 2.9.0 itself. A fix is available in version 2.9.0.

A security vulnerability (CVE-2026-27622) in the OpenEXR package used by Red Hat Enterprise Linux 10.0 Extended Update Support allows arbitrary code execution via an integer overflow during EXR file processing. This vulnerability has been rated as important by Red Hat Product Security. An update is available to address this issue.

CVE-2026-34045 is a vulnerability in Podman Desktop, an open-source graphical tool for managing containers and Kubernetes environments on the desktop. The flaw involves an unauthenticated HTTP server that can be exploited to cause denial of service and information disclosure. The issue affects versions prior to 1.26.2 and is fixed in version 1.26.2. Red Hat has issued an important security advisory and released updates to address this vulnerability.

Multiple security vulnerabilities were identified and fixed in OpenSSL, affecting various Ubuntu releases and potentially other Linux distributions. These issues include incorrect negotiation of TLS 1.3 key exchange groups, improper memory handling in DANE clients and delta CRL processing, and errors in processing crafted CMS EnvelopedData messages. Some vulnerabilities could lead to denial of service or remote code execution, while one could allow information disclosure. Fixes are available through updated OpenSSL packages in supported Ubuntu releases.

CVE-2026-1188 is a vulnerability in IBM Semeru Runtime, a Java Runtime Environment. The vulnerability potentially allows code execution. The affected versions include IBM DB2 and versions 12.1.0 through 12.1.4. No CVSS score or detailed impact information is provided. There is no information about available patches or exploits in the wild.

Multiple vulnerabilities have been identified in the Hitachi Virtual Storage Platform (VSP), a storage solution with virtualization capabilities. Specific details about the nature, impact, and affected versions of these vulnerabilities are not provided in the available information.

Multiple vulnerabilities in ImageMagick have been identified that allow denial of service conditions. ImageMagick is a suite of libraries and tools for processing graphics in many formats. No specific affected versions or detailed technical information are provided.

Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.

Multiple vulnerabilities have been identified in Ruby on Rails, an open-source web application framework written in Ruby. The vulnerabilities affect versions prior to 7.2.3.1. A fix is available in version 7.2.3.1. The vendor advisory from Red Hat confirms the availability of patches and recommends updating to the fixed version. No known exploits in the wild have been reported.

A vulnerability in strongSwan's eap-ttls plugin allows specially crafted network traffic to cause resource consumption or crash, resulting in denial of service. This issue affects multiple Ubuntu releases and can be mitigated by updating to fixed package versions.

A vulnerability in Red Hat JBoss Enterprise Application Platform versions prior to 8.1.5 allows remote attackers to cause a denial of service by manipulating the Vert.x Web static handler cache. This manipulation results in legitimate users receiving HTTP 404 responses when accessing static files such as images, CSS, or HTML. The underlying server and API endpoints remain unaffected. Red Hat has released version 8.1.5 to address this issue.

A vulnerability in libexif, a library used for processing and storing Exchangeable Image File Format (EXIF) data, affects versions up to 0.6.25. The flaw potentially allows code execution. The issue is publicly known but no CVSS score or detailed technical impact is provided.

Multiple vulnerabilities have been identified in Next.js, a React-based web application framework, affecting versions prior to 16.1.7. These include issues such as unbounded disk cache growth that can exhaust storage and server-side request forgery in server actions. Red Hat has released a security update fixing these vulnerabilities in version 16.1.7.

Multiple vulnerabilities have been identified in SmarterMail, a mail server software by SmarterTools. Specific details about the nature of these vulnerabilities, affected versions, and their impact have not been provided.

Multiple vulnerabilities in Wireshark allow denial of service conditions due to buffer over-read and improperly controlled sequential memory allocation. These issues affect Wireshark versions prior to 4.6.4 and version 4.6.4 itself. A security update fixing these vulnerabilities is available in version 4.6.4. The vulnerabilities have been rated with moderate severity by Red Hat and are addressed in their advisory.

Multiple vulnerabilities have been identified in IBM App Connect Enterprise versions prior to 13.0.6.2. IBM App Connect Enterprise integrates IBM Integration Bus technologies with cloud-native technologies. These vulnerabilities are addressed in version 13.0.6.2.