Security Bulletin: MongoDB Enterprised Advanced affected by: Deserialization of Untrusted Data (CVE-2026-42778, CVE-2026-42779)

Summary There are vulnerabilities in mina-core-2.2.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-42778, CVE-2026-42779. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-42778 DESCRIPTION: The fix for CVE-2026-41409 was not applied to the 2.1.X...

iocx v0.7.6.1

IOCX Deterministic, Zero‑Risk IOC Extraction for Modern Security Pipelines Static IOC extraction from a PE file using the IOCX CLI Official IOCX Project This is the original IOCX engine for deterministic static IOC extraction and PE analysis. Any other repositories using the name "iocx" are not...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

checkov v3.3.16

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84654

In Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6 ), which are included in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), a form data binding vulnerability exists. This flaw allows an attacker capable of submitting configuration forms to modify public static fields...

EUVD-2026-70120

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The /snippets/filepath route handler serveSnippets in kernel/server/serve.go performs a bare filepath.Joinutil.SnippetsPath, filePath on the single-decoded c.Request.URL.Path and serves the result with c.File, with NO IsSubPath containme...

firmwalker

firmwalker Простой bash-скрипт для поиска в извлеченной или смонтированной файловой системе прошивки. Он будет искать в извлеченной или смонтированной файловой системе прошивки интересующие элементы, такие как: etc/shadow и etc/passwd список каталога etc/ssl поиск файлов, связанных с SSL, таких к...

PT-2026-84777

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify...

Form submission data binding can set static fields

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of...

Directory Traversal

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Directory Traversal in the toSSG static site generation function, whose path normalization does not fully collapse runs of consecutive .. segments and treats output directories that diffe...

CVE-2026-84365

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84365

Hono (a JavaScript web framework) has an incomplete fix for CVE-2026-39408 in its toSSG() static site generation method, affecting versions from 4.12.12 and fixed in 4.13.5 . The path normalization routine used to verify output paths does not fully collapse runs of consecutive parent-directory se...

CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

zizmor v1.30.0

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...