CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

ROOT-APP-PYPI-GHSA-JJ8C-MMJ3-MMGV GHSA-jj8c-mmj3-mmgv in Authlib - Patched by Root

Root has patched GHSA-jj8c-mmj3-mmgv in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-28490 CVE-2026-28490 in Authlib - Patched by Root

Root has patched CVE-2026-28490 in the Authlib package for Root:PyPI. Multiple fixed versions available...

JLSEC-2026-1101

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unitoffset + unitsize. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector...

JLSEC-2026-1095

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

Exploit for CVE-2026-64560

CVE-2026-64560 — Linux Kernel posix-cpu-timers Non-leader exec...

Exploit for CVE-2026-64531

ovswrap-poc CVE-2026-...

ROOT-APP-MAVEN-CVE-2023-20862 CVE-2023-20862 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2023-20862 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38827 CVE-2024-38827 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-38827 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-69075

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075

FlowIntel is affected by a stored XSS via multiple stored fields that are rendered within Vue templates. An authenticated user can inject Vue interpolation expressions into fields (case/title/ticket/organization/role/profile, etc.). When other users view affected pages, the application may evalua...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses form-data which is vulnerable to CVE-2026-12143

Summary IBM Maximo Application Suite - Visual Inspection component uses form-data which is vulnerable to CVE-2026-12143, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating...

ROOT-APP-MAVEN-CVE-2025-55754 CVE-2025-55754 in io.root.org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2025-55754 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-24549 CVE-2024-24549 in io.root.org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2024-24549 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments incorporates Oracle's January 2026 Critical Patch Update (CPU) to fix multiple security vulnerabilities (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)

Summary IBM Storage Protect Data Protection for Virtual Environments incoprporates the security fixes related to Oracle's January 2026 Critical Patch Update CPU. The IBM SDK, Java Technology Edition Critical Patch Update CPU bundles several security updates from Oracle to address multiple...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

CVE-2026-20493

In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: BORA00154903; Issue ID: MSV-7575...

CVE-2026-20495

In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296...