PT-2026-104543

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.19 Description The plugin is susceptible to Local File Inclusion, a flaw that allows an attacker to include files from the local server. Authenticated...

PT-2026-104538

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.4 Description Authenticated users with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do...

CVE-2026-103519: Improper Control of Generation of Code

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

GHSA-V2F8-6655-7GRJ Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Summary: 5 findings — unauthenticated full-API exposure F1, lead Critical, read-side authorization gap that persists even with APIAUTHKEY set F2, unauthenticated file write of .py/.sh/.yaml to a server-returned path F3, default-permissive CORS that combines with a loopback-only check to grant any...

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Summary: 5 findings — unauthenticated full-API exposure F1, lead Critical, read-side authorization gap that persists even with APIAUTHKEY set F2, unauthenticated file write of .py/.sh/.yaml to a server-returned path F3, default-permissive CORS that combines with a loopback-only check to grant any...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2020-5258 DESCRIPTION: In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject...

Security Bulletin: User Entity Behavior Analytics App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. User Entity Behavior Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2011-4969 DESCRIPTION:...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in September 2026. Vulnerability Details CVEID:CVE-2025-71329 DESCRIPTION: image-size through 2.0.2 contains a denial of...

CVE-2026-103956

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

EUVD-2026-91770

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956

Loom for AWS versions before 1.6.1 are vulnerable to a critical flaw due to missing authentication for a critical function within the authentication dependency. In deployments where no identity provider is configured, remote actors can exploit this via any request to the application API to obtain...

Relapse-Exploit-for13.6.0

PS5 Relapse Exploit & 4-Player Multiplayer Subsystem Firmware...

Security Bulletin: Multiple secuirty vulnerabilities addressed with IBM Business Automation Workflow traditional and containers September 2026

Summary In addition to updating many operating system level packages, IBM Business Automation Workflow traditional and container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-53668 DESCRIPTION: React Router is a router for React. In versions 6.30.2 through 6.30...

Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware

iQOO Neo7 Racing Edition PD2232 – BL-Free Privilege Escalati...

semgrep v1.179.0

Code scanning at ludicrous speed. Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows. Semgrep is...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-29074 DESCRIPTION: SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1,...