Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Security Bypass.

Summary golang-jwt/jwt is used by IBM Storage Fusion Data Foundation, which could cause Security Bypass. CVE-2024-51744, CVE-2025-30204. Vulnerability Details CVEID:CVE-2024-51744 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Open Redirect.

Summary fast-uri is used by IBM Storage Fusion Data Foundation, which could cause Open Redirect. CVE-2026-6321. Vulnerability Details CVEID:CVE-2026-6321 DESCRIPTION: fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal...

CVE-2024-7344

🐞 CVE-2024-7344: 잘못된 PE 이미지 로딩 이 저장소는 UEFI 시스템에 영향을 미치는 Secure Boot 우회 취약점인 CVE-2024-7344와 관련된 연구 자료를 포함합니다. 취약점에 대한 기술적 분석, 공격 흐름 문서화, 그리고 통제된 환경에서 취약한 동작을 재현하도록 설계된 재구성 애플리케이션을 중앙 집중식으로 제공합니다. 또한 보안 연구자들이 이 취약점과 관련된 기술을 이해하고, 연구하고, 실험하는 데 도움이 되도록 설계된 문서 및 연구 리소스도 포함되어 있습니다. 📑 목차 최초 발견 및 공식 참고 자...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609

xmldom (a pure JavaScript W3C XML DOM module) is vulnerable in versions 0.9.0 through 0.9.12 due to a flaw in lib/grammar.js. The shared reg() builder compiles the anchored QName_exact validator with the multiline flag , causing ^ and $ to validate only one line rather than the full name. As a re...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ 인증되지 않은 권한 상승을 통한 관리자 계정 생성 ♡ === shadow ♡ & friska === 📋 취약점 정보 필드| 세부사항 ---|--- CVE ID| CVE-2026-8732 CVSS 점수| 9.8 심각 CVSS 벡터| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 유형| 중요 기능에 대한 인증 누락 플러그인| WP Maps Pro wp-google-map-gold 영향 받는 버전| 모든 버전 ≤ 6.1.0 패치 버...

CVE-2026-83608 xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENTTYPENODE branch in lib/dom.js validates publicId, systemId, and internalSubset under...

CVE-2026-83608

xmldom (a pure JavaScript XML DOM module) is vulnerable to a DocType name injection that bypasses the requireWellFormed strict mode. The DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim; a name containing > or whitesp...

CVE-2026-83608 xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENTTYPENODE branch in lib/dom.js validates publicId, systemId, and internalSubset under...

CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-84218

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...

CVE-2026-79684

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges...

EUVD-2026-69214

A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be...

CVE-2026-84110

Releasit COD Form & Upsells v1 contains a vulnerability in its OTP Validation component where server-side security is enforced only on the client side, allowing remote attackers to bypass one-time password validation without authentication or user interaction. The vulnerability results in a low i...

CVE-2021-40346

CVE-2021-40346 — HAProxy Integer Overflow leading to HTTP Request Smuggling 취약점 요약 HAProxy는 오픈소스 기반 리버스 프록시 겸 로드 밸런서로, 부하 분산 및 ACL접근 제어 규칙 처리 등을 담당하는 소프트웨어임 CVE-2021-40346은 HAProxy가 HTTP 헤더를 내부 HTX 포맷으로 저장하는 htxaddheader 함수에서 헤더 이름Header Name의 길이를 검증하지 않는 과정에서 발생하는 접근 제어 우회ACL Bypass 취약점 이 취약점은...

CVE-2026-79686

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges...

CVE-2026-79686

Dell PowerStore contains a Protection Mechanism Failure vulnerability that allows an authenticated user with limited privileges to bypass access restrictions and gain escalated privileges. The Dell-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicat...

EUVD-2026-69213

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges...

CVE-2026-80047

Hugging Face Transformers (versions 4.49.0 through 5.8.1) contains a consent-bypass flaw in GenerativePreTrainedModel.load_custom_generate() . The function fetches and writes a remote Python module to ~/.cache/huggingface/modules via an unconditional file copy in dynamic_module_utils.py before ev...