Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 3.0.1.1 Vulnerability Details CVEID:CVE-2026-102991 DESCRIPTION: Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-21998 DESCRIPTION: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8...

Exploit for Cross-site Scripting in Concretecms Concrete_Cms

CVE-2026-18116 Stored XSS via Calendar Event Name to Admin...

Exploit for Cross-site Scripting in Concretecms Concrete_Cms

CVE-2026-18116 Stored XSS via Calendar Event Name to Admin...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.5 Vulnerability Details CVEID:CVE-2016-1000027 DESCRIPTION: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat

Summary IBM HTTP Server used by IBM WebSphere Application Server is affected by multiple vulnerabilities due to libexpat and the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2026-66046 DESCRIPTION: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic...

PT-2026-114299

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check mimetype function. This is due to incomplete file type validation in the check mimetype function — while some extension checking is...

PT-2026-114367

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the do close on exec function is called while holding the exec update lock. Because do close on exec can block while waiting for a response from a filesystem, a hun...

Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery

Summary Apache IoTDB is an industrial IoT time-series database management system that adopts a lightweight architecture with edge-cloud collaboration, supporting integrated collection, storage, management, and analysis of IoT time-series data. It features multi-protocol compatibility, ultra-high...

PT-2026-113945

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.26 Description Authenticated users with permissions to edit dataset fields and chart configurations can inject HTML into a dimension value within a bar-horizontal chart. When the lengthLimit truncates the catego...

PT-2026-114295

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.15.0+dev Description An unauthenticated attacker can exploit a backslash normalization mismatch in the /redirect endpoint and similar post-action redirect flows. The IsSameSite function in internal/urlx/urlx.go validat...

PT-2026-114063

Name of the Vulnerable Software and Affected Versions Swetrix Cloud versions prior to 5.1.0 Description An authorization flaw exists in the addProject function within the ProjectController. This issue allows authenticated users to hijack arbitrary projects by moving them into an organization they...

Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery

Apache IoTDB version 2.0.11 contains an authenticated server-side request forgery vulnerability in the user-defined function mechanism. Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery Vendor: The Apache Software Foundation Product web page: https://iotdb.apache.org Affected version:...

PT-2026-113937

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0 Description A scope bypass exists in the ChainAuthHandler of Eclipse Vert.x Web...

Bisheng has authentication bypass vulnerabilities

Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on SSO endpoint; an Insecure Direct Object Reference IDOR vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perfor...

PT-2026-114022

Insertion of sensitive information into log files in the git utils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because...

CVE-2026-110248: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-86461: Unrestricted Upload of File with Dangerous Type

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

Microsoft Patch Tuesday, October 2026 Security Update Review

Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches promptly remains critical to reducing exposure and strengthening...