Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-48714 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, th...

Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI products - 1 EDB PGAI AI Factory with IBM 1.3.0, 2 EDB PGAI Analytics Accelerator 1.3.0, and 3 EDB PGAI Hybrid Data Management 1.3.0. The vulnerabilities have been addressed in 1.4.1 version. Hence, IBM strongly recommends upgrading to 1.4.1...

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...

GHSA-7C92-X8VG-4258 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...

Security Bulletin: InfoSphere Data Architect (IDA) 9.2.2 Vulnerability Fixes

Summary Security Bulletin: Multiple vulnerabilities getting fixed with InfoSphere Data Architect IDA 9.2.2. Hence, IBM strongly recommends upgrading to v9.2.2 Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or...

PT-2026-107649

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...

SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:4534-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4534-1 advisory. - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined bsc1259611. - CVE-2026-0864...

Security Bulletin: Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS

Summary Vulnerabilities in PostgreSQL could allow Memory Corruption/Arbitrary Code Execution CVE-2026-14662, CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-14679, CVE-2026-14680, CVE-2026-15742, CVE-2026-16239, CVE-2026-19385, Information Disclosure...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 1.0 - NRS have been addressed in version 3.0.5.4 Vulnerability Details CVEID:CVE-2026-62574 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Ja...

The Hidden DoS Vector in SQL Parsers

SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. Our research focused on two...

Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS

IBM SECURITY ADVISORY First Issued: Tue Oct 6 01:00:55 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/postgresadvisory2.asc Security Bulletin: Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS...

GHSA-WJWH-QQVP-G4P4 vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

Summary There is a sandbox escape in vm2 3.11.5 / current HEAD when it is used on Node.js 26. The issue is reachable from a default new VM sandbox. No NodeVM, require permission, host object injection, or intentionally unsafe configuration is required. The escape is a patch-bypass of the same...

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

Summary There is a sandbox escape in vm2 3.11.5 / current HEAD when it is used on Node.js 26. The issue is reachable from a default new VM sandbox. No NodeVM, require permission, host object injection, or intentionally unsafe configuration is required. The escape is a patch-bypass of the same...

CVE-2023-44761_ConcreteCMS-Stored-XSS---Forms

ConcreteCMS Stored XSS v.9.2.1 著者: Sergio 説明: ConcreteCMS v.9.2.1 には複数のクロスサイトスクリプティング（XSS）の脆弱性が存在し、ローカル攻撃者が Data Objects の Forms に細工したスクリプトを介して任意のコードを実行できる可能性があります。 攻撃ベクトル: スクリプティング "Data Objects" の Forms への入力のサニタイズ処理に脆弱性があり、ユーザーがWebページにアクセスしたときに実行されるJavaScriptコードを注入できる可能性があります。 POC:...

CVE-2026-42647-Lab

CVE-2026-42647 - JoomSport 認証不要の時間ベースのブラインドSQLインジェクション（sortf経由） エグゼクティブサマリー このリポジトリには、CVE-2026-42647を再現および検証するためのローカルDockerラボが含まれています。この脆弱性は、WordPressプラグインJoomSport（スポーツ向け：チーム＆リーグ、フットボール、ホッケーなど）に影響を与える認証不要のSQLインジェクションです。 脆弱な動作は、選手リストの並べ替え機能で発生します。一般の訪問者は、sortfクエリパラメータを制御でき、これはSQLのORDER...

ReactOOPS-WriteUp

ReactOOPS - HTB WebチャレンジWriteup 著者 : TheStingR - Team ISP1337Hackers チャレンジ : ReactOOPS Web プラットフォーム : Hack The Box 難易度 : Very Easy - 引退済み 解決日 : 2025年12月13日 目次 1. エグゼクティブサマリー 2. チャレンジの説明 3. 脆弱性分析 4. 偵察と列挙 5. 悪用のウォークスルー 6. フラグの抽出 7. 技術的な詳細 8. 防御と緩和策 9. 学んだ教訓 エグゼクティブサマリー ReactOOPS は、React Server...

bochs_linux_kernel_debugging

bochslinuxkerneldebugging 用于在 Bochs 上进行 Linux 内核调试的工具（包括符号、原生 Bochs 调试器和 IDA PRO） 为 Linux 内核调试生成符号文件 按以下步骤操作： 0- 生成 nm 风格的调试信息文件 只需对调试内核映像使用 nm 命令，以 Debian 为例： 1- 安装 dbg 镜像 root@debian apt-get install linux-image-$uname -r-dbg 2- 检查 nm 是否能处理 dbg 镜像： dreg@debian nm /usr/lib/debug/boot/vmlinux-$una...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React Server Components RCE A Proof-of-Conce...

selenium-wire

Selenium Wire is no longer being maintained. Thank you for your support and all your contributions. Selenium Wire Selenium Wire extends Selenium's Python bindings to give you access to the underlying requests made by the browser. You author your code in the same way as you do with Selenium, but y...

openSUSE 16 Security Update : pcapplusplus (openSUSE-SU-2026:22017-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22017-1 advisory. Changes in pcapplusplus: - Update to version 26.07 libpcap / WinPcap / Npcap is now optional. Bumped the minimum required C++ standard to C++14...