CVE-2026-63722

ICEcoder 8.1 is vulnerable to unauthenticated remote code execution via the terminal-xhr.php endpoint. Attackers chain three flaws: a password parameter bypasses authentication, a non-empty csrf parameter skips CSRF validation, and an arbitrary command string is passed directly to proc_open(), yi...

GHSA-2C9Q-C2Q9-QGQV langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

Summary In affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — Marimo Pre-Authentication RCE !CVEhttps:/...

CVE-2026-16835 Power System Improper Certificate Validation

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...

EUVD-2026-62691

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...

CVE-2026-16835

CVE-2026-16835 is a CRITICAL (CVSS 9.6) vulnerability in the FSP management network protocol of IBM Power Systems Firmware, caused by improper certificate validation (CWE-295). An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation...

CVE-2026-16835 Power System Improper Certificate Validation

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...

CVE-2026-73136

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...

CVE-2026-67581

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-66794

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

UBUNTU-CVE-2026-63652

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

CVE-2026-71126

creationtimestamp| type| source ---|---|--- 2026-08-19 18:16:41+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-71116

creationtimestamp| type| source ---|---|--- 2026-08-19 18:15:43+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

CVE-2026-49870

In Snipe-IT before v8.6.0, the POST /two-factor endpoint lacked rate limiting, lockout, or attempt counters, allowing an attacker with valid credentials to brute-force TOTP codes (3 of 1,000,000 accepted due to window=1). A successful guess grants a full authenticated session. In optional 2FA mod...

CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

CVE-2026-61281

creationtimestamp| type| source ---|---|--- 2026-08-19 17:52:41+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-29 19:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mual57vgze23...

CVE-2026-70904

creationtimestamp| type| source ---|---|--- 2026-08-19 17:52:24+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-29 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mua2erwkux2x...

CVE-2026-61302

creationtimestamp| type| source ---|---|--- 2026-08-19 17:52:10+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-29 04:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu6ytvvxke2y...