Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Neethi (CVE-2026-66142,CVE-2026-66143 & CVE-2026-66144)

Summary IBM App Connect Enterprise runtime is vulnerable to a denial of service due to Apache Neethi. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which ma...

Security Bulletin: IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service (CVE-2026-75624)

Summary IBM App Connect Enterprise runtime is vulnerable to privilege escalation and Denial of Service. Vulnerability Details CVEID:CVE-2026-75624 DESCRIPTION: IBM App Connect Enterprise could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

Summary IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs Vulnerability Details CVEID:CVE-2026-17416 DESCRIPTION: IBM App Connect Enterprise could allow a local attacker to execute arbitrary code due to insecure deserialization. CWE:CWE-502:...

CVE-2026-6223

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 before 2.3...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules fast-uri, postcss, axios, jsonata and body-parser...

CVE-2026-6223 OTP Bypass in Bahçelievler Muncipality's BiHayat App

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 before 2.3...

EUVD-2026-72369

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-6223 OTP Bypass in Bahçelievler Muncipality's BiHayat App

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-6223

CVE-2026-6223 is a CRITICAL (CVSS 9.4) improper restriction of excessive authentication attempts vulnerability in the Bahçelievler Municipality BiHayat App (versions 2.1.7 through 07092026), allowing an OTP bypass that leads to full authentication bypass. The vector is network-based with no privi...

EUVD-2026-72354

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

Veto v2.3

Veto An open source VirusTotal client for Android Free and open source. Bring your own VirusTotal API key to scan files, links, and installed applications against over 70 engines, built with a Material 3 interface. No accounts, no tracking, no ads. What is Veto? Veto is an Android client for...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver (CVE-2026-39244, CVE-2026-54466 and CVE-2026-54490)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver. Vulnerability Details CVEID:CVE-2026-39244 DESCRIPTION: adm-zip before 0.5.18 is...

Aegis v3.4.3

Aegis Authenticator Aegis Authenticator is a free, secure and open source 2FA app for Android. It aims to provide a secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups. Aegis supports HOTP and...

CVE-2026-86347: Missing Authorization

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

CVE-2026-86492: Exposure of Data Element to Wrong Session

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App lies in the use of an unreliable search path, allowing attackers to escalate their privileges.

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to the use of an unreliable search path. Exploiting this vulnerability can allow attackers to increase their privileges...

PT-2026-86864

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86490: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...

PT-2026-86862

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...

CVE-2026-86285: Improper Access Control

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...