Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the stream resource type, which allows bypassing intended security checks on PHP stream wrappers. An attacker can read arbitrary local files accessible to the PHP process by including specially crafted templa...

Task4-Exploitation-System-Security

Task 4: Exploitation & System Security Cybersecurity & Ethi...

Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and open62541

Summary IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and open62541. Vulnerability Details CVEID:CVE-2026-56745 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through...

Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance

Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-42586 Vulnerability Details CVEID:CVE-2026-42586 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, t...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by URI path normalization vulnerability due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Cloud Pak for Data System 1x to provide web application server functionality. CVE-2026-8384 affects Jetty's URI path handling when processing non-canonical paths containing path traversal sequences, resulting in unresolved paths being passed to web application...

RUSTSEC-2026-0345 Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

Affected versions of kuva wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input column headers, category and group names, series labels were affected in three places. 1. SVG attribute injection / stored XSS...

Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

Affected versions of kuva wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input column headers, category and group names, series labels were affected in three places. 1. SVG attribute injection / stored XSS...

Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename

Summary form-data versions through 4.0.5 are vulnerable to CRLF injection CWE-93, CVSS 7.5, High. Field names and filenames passed to FormDataappend are not sanitized before being written into the Content-Disposition header, allowing an attacker who controls those values to inject arbitrary heade...

Security Bulletin:Axios Prototype Pollution: Intercept JSON Responses or Hijack HTTP Transport

Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can a silently intercept and modify every JSON response before...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.14.0 Vulnerability Details CVEID:CVE-2026-14620 DESCRIPTION: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and...

CVE-2026-61632

A flaw was found in PyMdown Extensions. The b64 extension, used for inlining images in Markdown, is vulnerable to a path traversal issue. An attacker can craft untrusted Markdown with specially formed image source containing directory traversal sequences e.g., ../ or absolute paths. This allows t...

Security Bulletin: due to the use of Apache Log4j, IBM Transformation Extender Advanced is vulnerable to hostname verification bypass and log injection via CRLF sequences

Summary Apache Log4j is used by IBM Transformation Extender Advanced also known as IBM Standards Processing Engine as part of common utility helpers. Apache Log4j has been updated to address CVE-2026-34477 which causes hostname verification bypass and CVE-2026-34478 which causes log injection via...

vigolium v0.3.9

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-27903 DESCRIPTION: minimatch is a minimal matching utility for converti...

PT-2026-69027

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.2 Description A Relative Path Traversal issue exists where a low privileged attacker with remote access could potentially gain unauthorized access to the filesystem. Relative Path...

PT-2026-69042

Name of the Vulnerable Software and Affected Versions SEBLOD versions prior to 3.30.0 SEBLOD versions prior to 4.7.0 SEBLOD versions prior to 6.0.1 Description An unauthenticated attacker can perform a path traversal attack to download files located both inside and outside the webroot. Path...

PT-2026-69130

Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0 Description The /$result endpoint allows a caller with a valid async export job ID to provide file parameter values containing path traversal sequences. The handler verifies the job but fails to normaliz...

CVE-2026-47661: Improper Limitation of a Pathname to a Restricted Directory

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-47659: Improper Limitation of a Pathname to a Restricted Directory

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-61477: Improper Neutralization of CRLF Sequences

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...