PT-2026-108047

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to web and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

CVE-2026-107296: Modification of Assumed-Immutable Data (MAID)

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks,...

Linux Distros Unpatched Vulnerability : CVE-2026-107230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14,...

Linux Distros Unpatched Vulnerability : CVE-2026-107363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keysto...

Linux Distros Unpatched Vulnerability : CVE-2026-107565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS...

PT-2026-108237

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description Remote unauthenticated attackers can execute arbitrary code on the system, including appliance and container variants...

PT-2026-108176

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Stored cross-site scripting XSS exists in the Quick Search results grid. An unauthenticated attacker capable of influencing monitored database traffic can execute malicious scripts within t...

PT-2026-107865

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

PT-2026-108266

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.0 through 12.2 Description A path traversal issue in the Sniffer component allows a remote attacker to execute arbitrary code. Path traversal is a flaw that allows an attacker to access files and...

PT-2026-108180

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.1 IBM Guardium Data Protection version 12.2.2 Description The edge-controller component lacks proper authentication. This allows an unauthenticated remote attacker to execute arbitrary container images a...

Exploit for CVE-2025-58226

CVE-2025-58226 — 3D FlipBook ≤ 1.16.16 Unauthenticated Sensiti...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (September 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-59869 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From...

CVE-2026-92542

A flaw was found in Moby. Firewall rules for encrypted Swarm overlay networks fail to distinguish between authentic kernel traffic and packets crafted by user processes. A local attacker can exploit this flaw by sending forged Virtual Extensible LAN VXLAN datagrams matching the overlay network...

CVE-2026-76280

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...

CVE-2026-76277

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edituser capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the...

CVE-2026-76270

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...

DEBIAN-CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107230 AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins...

CVE-2026-76280 Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...