CVE-2026-18058

The mobile Smart Connect dashboard UI (referenced via Motorola support, with CNA from Lenovo PSIRT ) was vulnerable to manipulation by third-party apps . When combined with a phishing attack , this manipulation could lead to privilege escalation for an attacker within the system. The vulnerabilit...

CVE-2026-18058

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

CVE-2026-18058

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

EUVD-2026-70110

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-82398 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-82398 Source advisory:...

Multiple vulnerabilities in ShizenBox2

Overview ShizenBox2 provided by Shizen Connect Inc. contains multiple vulnerabilities listed below. Improper physical access control CWE-1263 - CVE-2026-80253 Authorization bypass through user-controlled key CWE-639 - CVE-2026-80254 CVE-2026-80253 Naohide Waguri of PwC Consulting LLC reported thi...

Debian dla-4768 : libapache2-mod-auth-openidc - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4768 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4768-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-18058: Missing Authorization

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

PT-2026-84755

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

PT-2026-84830

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.to atom/1 before...

CVE-2026-55221: Insertion of Sensitive Information into Log File

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh...

PT-2026-84831

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh...

[SECURITY] Fedora 44 Update: opkssh-0.16.0-2.fc44

OpenPubkey SSH is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like aliceaexample.com ins tead of long-lived SSH keys...

[SECURITY] Fedora 43 Update: opkssh-0.16.0-2.fc43

OpenPubkey SSH is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like aliceaexample.com ins tead of long-lived SSH keys...

SUSE CVE-2026-72243

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

CVE-2026-26448

A flaw was found in Stomper. A remote attacker can trigger a use-after-free vulnerability by sending multiple CONNECT frames on the same TCP connection, followed by SEND frames to a previously subscribed destination. This can cause the broker to dereference a freed memory region, leading to a hea...

CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an Interpretation Conflict due to Node.js module fast-uri (CVE-2026-16221)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to an Interpretation Conflict due to Node.js module fast-uri Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0...

PT-2026-83848

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.2 Description An unauthenticated remote code execution issue exists in the ProfilePress WordPress plugin. Unauthenticated attackers can install and activate arbitrary plugins by brute-forcing a weak 32-bit...