9428 matches found
Security Bulletin: Multiple secuirty vulnerabilities addressed with IBM Business Automation Workflow traditional and containers September 2026
Summary In addition to updating many operating system level packages, IBM Business Automation Workflow traditional and container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-53668 DESCRIPTION: React Router is a router for React. In versions 6.30.2 through 6.30...
Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...
openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21999-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21999-1 advisory. Changes in rclone: - Update to version 1.75.1: boo1279548 - Security - archive - Fix zip slip path traversal in untrusted zip files...
PYSEC-2026-4143 PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated. PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts...
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
PYSEC-2026-4034 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
SummaryDecepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
PYSEC-2026-4032 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
PYSEC-2026-4033 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...
GHSA-H85J-HV3C-QFGQ vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...
GHSA-8HR7-R645-PC6W vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...
Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps
Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.2.0 Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof...
Working-POC
ASENT — Integrated Security Assurance A runnable FAST-NUCES F...
Security Bulletin: IBM Maximo Application Suite uses third party libraries which is vulnerable to multiple cves.
Summary IBM Maximo Application Suite uses busboy 3.2.0, cryptography 46.0.7, browserslist 4.24.4, form-data 2.5.5, brace-expansion 1.1.14, socket.io-parser 4.2.6, fast-xml-parser 5.9.3, immutable 5.1.5, postcss 8.5.15, libarchive 3.5.3-9.el97, dompurify 3.4.0, ip-address 10.1.1, fast-uri 3.1.2,...
Exploit for Improper Input Validation in Citrix Netscaler_Application_Delivery_Controller
pitscaler.com Static briefing served by the Cloudflare Worker...
PT-2026-105790
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
PT-2026-105791
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...