Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers,I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. SummaryThe jk parameter is received in pyLoad CNL Blueprint. Due to the lack of j...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879243...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: OSV:GHSA-MRRP-9GJM-749V...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: GHSA-MRRP-9GJM-749V...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: MEND:CVE-2026-46592...

blueprint-ytls (0.0.1), ctutils (>=0.0.0, <=0.3.2) potentially affected by CVE-2026-50185 via cmov (>=0.4.6, <=0.5.0-pre.0)

cmov CARGO version =0.4.6, =0.0.0, =0.3.2 Source cves: CVE-2026-50185 Source advisory: GHSA-3RJW-M598-PQ24...

PYSEC-2026-414 misp-modules website - Missing CSRF protection in the website home blueprint

A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of sessi...

misp-modules website - Missing CSRF protection in the website home blueprint

A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of sessi...

CERT-In’s AI Vulnerability Blueprint: Why Indian CISOs Need Machine-Speed Risk Operations in the Post-Mythos Era

A Qualys India perspective on CERT-In 's blueprint, the post-Mythos threat landscape India faces, and why the operating model needs to change. Key Takeaways Mythos-class AI changes the vulnerability equation from CVE matching to autonomous exploit discovery, turning known, unpatched weaknesses in...

CVE-2026-29179

October is a Content Management System CMS and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access...

CVE-2026-41325

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint site/blueprints/users/.... It is also possible to customize th...

CVE-2026-42844

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full...

CVE-2026-39552

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5...

PT-2026-46318

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-39552

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5...

EUVD-2026-33915

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5...

CVE-2026-39552

CVE-2026-39552 affects the WordPress Blueprint theme prior to 1.1.5, which suffers from an Improper Control of Filename for Include/Require (PHP Local File Inclusion). The vulnerability arises from inadequate validation of included/required filenames, enabling an attacker to cause local file incl...

CVE-2026-39552 WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5...

CVE-2026-39552

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5...

CVE-2026-39552 WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5...