PT-2026-96839

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7.0 through 7.1.1 Description An unauthenticated attacker can exploit a path traversal flaw in the get page template function to include a readable local .php file located outside the active theme directories. This occurs...

PT-2026-96947

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description A confused deputy issue exists where the server can be forced to read arbitrary local files and attach them to a Jira issue, leading to the exfiltration of sensitive host files and environment...

CVE-2026-95701: Improper Limitation of a Pathname to a Restricted Directory

In MISP, the statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image. The original code called fileexists with a path constructed as APP . 'webroot' . DS . 'img' . DS . 'orgs' . ...

CVE-2026-93711: Improper Neutralization of CRLF Sequences in HTTP Headers

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

Multiple Apache Tomcat vulnerabilities

Moderate: Apache Tomcat: Fix for CVE-2025-66614 is incomplete CVE-2026-32990 The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed. Important: Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attac...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

SUSE CVE-2026-11720

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in form-data 4.0.5

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source package axios which transitively depends on package form-data, which is affected by a high severity vulnerability. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed...

Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) images by vulnerabilities in github.com/caddyserver/caddy/v2 package

Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark images by vulnerabilities in github.com/caddyserver/caddy/v2 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-27587 DESCRIPTION:...

USN-8726-3: Linux kernel (IBM) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

USN-8726-3 linux-ibm vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in form-data (CVE-2026-12143)

Summary An HTTP header injection vulnerability in the form-data multipart stream creation library CVE-2026-12143 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.0.6. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a libra...

Exploit for Path Traversal in Apple Macos

CVE-2026-84568 — Reverse engineering notes and reproduction I...

Zircolite v4.0.0

Standalone SIGMA-Based Detection Tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, or JSONL/NDJSON Logs Zircolite is a standalone tool written in Python 3 that allows you to use SIGMA rules on: MS Windows EVTX EVTX, XML, and JSONL formats Auditd logs Sysmon for Linux EVTXtract CSV and XML logs...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate with watsonx Assistant Cartridge version 5.4.2 Vulnerability Details CVEID:CVE-2026-44897 DESCRIPTION: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading builds the opening...

PT-2026-96224

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.27.6 Description The SSO return path using response mode=form post in the warpgate-protocol-http/src/api/sso provider list.rs file fails to neutralize script-closing sequences when using serde json::to string insid...

CVE-2026-55159: Improper Neutralization of CRLF Sequences

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

Linux Distros Unpatched Vulnerability : CVE-2026-93751

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII...

Security Bulletin: IBM Operator for Apache Flink is affected by Multiple Vulnerabilities

Summary IBM Operator for Apache Flink is affected by Multiple Vulnerabilities and was addressed in BM Operator for Apache Flink 1.5.5 Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname...

Security Bulletin: Multiple vulnerabilities addressed in IBM Big Replicate LiveData Migrator 4.0

Summary Multiple vulnerabilities addressed in IBM Big Replicate LiveData Migrator 4.0. The libraries affected include tomcat-embed-core-9.0.110.jar, i18next-http-backend-2.2.0.tgz, spring-web-5.3.39.jar, assertj-core-3.22.0.jar, ability-6.4.0.tgz, netty-codec-http-4.1.128.Final.jar,...