PT-2026-68234

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description Improper access control issues were identified during an internal security review. These issues fall under the Common Weakness Enumeration CWE Pillar CWE-284, which refers to...

CVE-2026-54876

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

PT-2026-68236

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description An issue exists involving improper control of a resource through its lifetime, which falls under the Common Weakness Enumeration CWE Pillar CWE-664. This was identified during a...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-48714 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, th...

Security Bulletin:UltraJSON Memory Leak Fix in ujson.dump() Prior to 5.12.1

Summary UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write...

CVE-2026-48399 Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657)

Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...

CVE-2026-41579

A flaw was found in runc, a tool used to run containers. A malicious container image, crafted with a specific type of symbolic link in its /dev directory, can deceive runc. This deception could lead to the deletion of certain files or the creation of predefined symbolic links on the host system...

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

pop filter bypasses memoryLimit accounting that its array-filter siblings enforce CWE: CWE-770 Allocation of Resources Without Limits or Throttling — sibling class of GHSA-8xx9-69p8-7jp3 and GHSA-2546-xv4c-mc8g, applied to memoryLimit instead of renderLimit Summary The pop array filter at...

PT-2026-64296

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...

PT-2026-64304

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.19 Loytec L-INX versions prior to 8.4.19 Loytec L-GATE versions prior to 8.4.19 Loytec L-ROC versions prior to 8.4.19 Loytec L-IOB versions prior to 8.4.19 Loytec L-DALI versions prior to 8.4.19 Loytec...

PT-2026-63364

Name of the Vulnerable Software and Affected Versions Ansible Lightspeed Visual Studio Code extension affected versions not specified Description A command injection flaw exists where the extension fails to properly validate user input as a file path within the ansible.python.activationScript...

Kibana 9.4.4 Security Update (ESA-2026-73)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. Affected Versions: 9.4.x: All versions from 9.4.0 up to and...

CVE-2026-63261 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

PT-2026-63265

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated attacker with low-privilege access can cause a denial of service by sending a specially crafted, oversized request payload. This triggers uncontrolled resource consumption...

PT-2026-61822

Missing Cryptographic Step CWE-325 vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with...

PT-2026-63266

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Uncontrolled Resource Consumption in Kibana can lead to a denial of service through excessive allocation. A low-privileged authenticated user can send a specially crafted request to a machine...

@agentspec/claude-plugin (>=0.1.0, <=0.2.0), @agentspec/sidecar (0.1.0) +86 more potentially affected by CVE-2021-21322 +1 more via @fastify/http-proxy (>=9.4.0, <=11.5.0)

@fastify/http-proxy NPM version =9.4.0, =0.1.0, =1.0.19, =2.1.22, =0.1.1, =0.1.0, =0.0.4, =0.0.4, =6.0.0-canary.2685, =0.0.4, =0.0.4, =4.0.0-canary.13864, =4.0.0-canary.13864, =0.0.4, =9.0.0-canary.1784 and more Source cves: CVE-2021-21322, CVE-2026-15631 Source advisory:...

Rocket.Chat: Stored HTML Injection (CWE-79) via Livechat Visitor Name

Vulnerability description not provided...

EUVD-2026-45140

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...