CVE-2026-45705

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...

wp2shell-Hestia-Scanner — Updated!

🛡️ wp2shell-Hestia-Scanner 🇬🇧 English | 🇬🇷 Ελληνικά Read-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators across all hosted sites — with per-client email reports, core file diff, SHA256 webshell detection, risk scoring, and optional AI evaluation. ⚠️ Safe...

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Summary Three OAuth2 credential endpoints look up credentials by id alone with no workspaceId filter. Two of these endpoints callback, refresh are whitelisted from all authentication. This allows: 1. Cross-workspace credential access — Any authenticated user can initiate OAuth2 flows against...

GHSA-WCH5-XP77-FXG4 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Summary Three OAuth2 credential endpoints look up credentials by id alone with no workspaceId filter. Two of these endpoints callback, refresh are whitelisted from all authentication. This allows: 1. Cross-workspace credential access — Any authenticated user can initiate OAuth2 flows against...

Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

Summary An Insecure Direct Object Reference IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulati...

GHSA-2364-JH4Q-M9VM Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

Summary An Insecure Direct Object Reference IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulati...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1995)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1995 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-015 (ALASNGINX1-2026-015)

The version of nginx installed on the remote host is prior to 1.30.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-015 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-2008)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2008 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

PT-2026-67893

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1 Description The find line delimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. This occurs...

PT-2026-75909

Summary An Insecure Direct Object Reference IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulati...

PT-2026-67934

Summary Three OAuth2 credential endpoints look up credentials by id alone with no workspaceId filter. Two of these endpoints callback, refresh are whitelisted from all authentication. This allows: 1. Cross-workspace credential access — Any authenticated user can initiate OAuth2 flows against...

SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:3440-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3440-1 advisory. Update to Tomcat 9.0.120: Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1997)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1997 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1996)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1996 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1999)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1999 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

Target: gitpython-developers/GitPython Tested: HEAD 07e80555 2026-07-25, latest release 3.1.55, git version 2.50.1 Reported instances: 2 exploitable, from a sweep of 14 unguarded call sites Summary GitPython blocks dangerous git options through Git.checkunsafeoptions, gated per method by an...