opencti v7.260930.0

Note: THREAD 2026 — 15 October, Paris. Our community conference for threat intelligence and cyber defense practitioners. Talks, labs, workshops, and an evening social. Join us → Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence...

CVE-2026-13720

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

Kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager

Cisco has identified a vulnerability in the Cisco Catalyst SD-WAN Manager. This vulnerability resides in an API of the Cisco Catalyst SD-WAN Manager. Due to improper handling of URI encoding, unauthorized malicious actors can circumvent authentication mechanisms. This allows malicious...

CVE-2026-13719

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface API to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is...

Exploit for CVE-2026-102971

CVE-2026-102971: hidden revision author ID disclosure Reporte...

CVE-2026-18783 Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES

Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29...

CVE-2026-18783

The Trex MES software by Trex Digital Smart Manufacturing Systems Inc. is vulnerable to an Authentication Bypass due to missing server-side authentication on a REST API endpoint . This vulnerability allows unauthorized access to critical functions. The issue affects versions through 2026-09-29 . ...

OESA-2026-4164 python-jupyter-server security update

The backend for Jupyter web applications Security Fixes: Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitra...

CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

EUVD-2026-89950

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-76504

A critical authentication bypass vulnerability exists in the Cisco Catalyst SD-WAN Manager API session-based authentication management. The root cause is improper handling of URI encoding (CWE-177) in HTTP requests, allowing an unauthenticated, remote attacker to bypass authentication rules and g...

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

Incorrect Behavior Order

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Incorrect Behavior Order via...

wordpress_exploit

Vulnerable Lab: CVE-2026-63030 WordPress This environment r...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

EUVD-2026-89778

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

CVE-2026-103012

The Claude Code application is vulnerable to a security flaw where it prioritizes locally stored API keys (from previous logins or configurations) over the server-managed settings of a valid Claude Enterprise or Team account. If the settings endpoint rejects the stored key, the session may start ...

Security Bulletin: IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844

Summary IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values durin...