CVE-2026-58343

A flaw was found in Moodle. Capability checks were missing from course assistance AI Artificial Intelligence placement web services. This could allow users to make requests to these web services without possessing the necessary permissions, potentially leading to unauthorized access to AI course...

RHSA-2026:46482 Red Hat Security Advisory: sssd security update

Bulletin has no description...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

igloohome Smart Lock Mobile Application

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure...

PT-2026-65591

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...

CVE-2026-16773: Exposure of Sensitive Information to an Unauthorized Actor

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...

CVE-2026-55391: Reliance on Reverse DNS Resolution for a Security-Critical Action

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

Veeder-Root TLS4B Command Injection (CVE-2025-58428)

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...

WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action vulnerability

Unauthenticated Sensitive Information Exposure in 'wpbotsendemailtranscript' AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...

Malicious Package

Overview sme-crm-services-sme-crm-services-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

ADOKit v1.4.2

ADOKit Description Azure DevOps Services Attack Toolkit - ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials API key or stolen...

Microsoft Fixes Certighost Flaw That Allowed Domain Controller Impersonation

Certighost allowed a low-privilege domain user obtain a valid Domain Controller certificate through AD CS. Microsoft patched the issue in the July security updates...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Hugging Face Transformers [CVE-2025-14920, CVE-2025-14921, CVE-2025-14926, CVE-2025-14927]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Hugging Face Transformers CVE-2025-14920, CVE-2025-14921, CVE-2025-14926, CVE-2025-14927. Hugging Face Transformers is used in our speech services runtimes. These vulnerabilities have been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in bouncycastle [CVE-2025-14813] [CVE-2026-0636] [CVE-2026-5598]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in bouncycastle, due to flaws in BC-JAVA on all core modules. CVE-2025-14813 CVE-2026-0636 CVE-2026-5598. Bouncy castle BC-JAVA is used in our speech microservices. This vulnerability has been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangSmith [CVE-2026-45134]

Summary IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangSmith, due to issues with an earlier version of the SDK's prompt pull methods and deserialize prompt manifests from the LangSmith Hub CVE-2026-45134. LangSmith is used in our runtime...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery (SSRF) in LangChain [CVE-2026-41481]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery SSRF in LangChain, due to a failure to revalidate to redirect targets, allowing a URL pointing to an attacker-controlled server to potentially redirect to internal, localhost, or cloud metadata endpoints,...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in Twisted [CVE-2026-42304]

Summary BM Watson Speech Services Cartridge is vulnerable to a DOS in Twisted, due to a flaw in the twisted.names module that can cause resource exhaustion during DNS name decompression CVE-2026-42304. Twisted is used in our speech runtimes. This vulnerability has been addressed. Please read the...

CVE-2026-65618

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents [CVE-2026-54399]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents, due to a flaw in the HTTP/1.1 message parser CVE-2026-54399. Apache HttpComponents is used in our Java Microservices. This vulnerability has been addressed...