PYSEC-2026-4114 Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

Security Bulletin: Due to Linux, IBM Cloud Pak System is affected by local privilege escalation vulnerability[ CVE-2026-31431]

Summary Vulnerability was found in Linux shipped with IBM Cloud Pak System OS Image for Red hat Linux Systems. Vulnerability was addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-31431 DESCRIPTION: In the Linux kernel, the following vulnerability has been...

Security Bulletin: IBM webMethods BPM is vulnerable to a denial of service due to jackson-databind

Summary IBM webMethods BPM uses Jackson Databind to serialize and deserialize JSON data between BPM processes, REST APIs, and Java objects. Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607

Summary IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607. This bulletin contains information regarding these vulnerabilities and their...

BIT-ELASTICSEARCH-2026-94408 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

Exploit for Insufficient Granularity of Access Control in Microsoft

BlueHammer Defender Compromise-Audit A defensive Metasplo...

CITADEL: CWE-Guided Insertion of Hardware Trojans Via Analysis of DFG-Enabled LLMs

The increasing sophistication of Hardware Trojans HTs and system-level vulnerabilities poses significant risks to modern integrated circuits. However, constructing realistic HT scenarios, remains a substantial burden: researchers must manually analyze complex RTL structures, identify plausible...

CVE-2026-104018: Improper Privilege Management

An improper privilege management vulnerability CWE-269 exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an...

PT-2026-104027

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting XSS. This issue affects CAPEC-63: before 3.0b63...

PT-2026-105103

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

Elasticsearch 8.x < 8.19.22 / 9.0.x < 9.4.7 / 9.5.x < 9.5.4 DoS (ESA-2026-176)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.22, or 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-176 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to...

CentOS Linux 8 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1788271978)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1788271978 advisory. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more...

PT-2026-105863

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The code challenge method plain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

AlmaLinux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788339545)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788339545 advisory. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memor...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to privilege escalation [CVE-2026-96012]

Summary IBM Db2 Mirror for i GUI is vulnerable to privilege escalation CVE-2026-96012 as described in the vulnerability details section. Vulnerability Details ID: CVE-2026-96012 DESCRIPTION: IBM Db2 Mirror for i GUI is vulnerable to privilege escalation. An authenticated attacker could craft a...

CVE-2025-26198

CVE-2025-26198 - Demostración de Inyección SQL Proyecto académico ENSIMAG - Seguridad 3A Autores: Wail Yacoubi, Mohammed-Yassine Akhmari Fecha: Enero 2026 Advertencia Este código es intencionalmente vulnerable con fines educativos. Nunca desplegar en producción. Descripción Reproducción de...

AuraForge: Scaling Security Supervision for Training Coding Agents

Coding agents are now proficient enough to generate complex software applications from a single prompt. As their capabilities have grown, human oversight has increasingly shifted from line-by-line code review toward hands-off evaluation of outcomes. However, recent studies have shown that such a...

Linux Distros Unpatched Vulnerability : CVE-2026-84784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remot...

OpenSSL 1.0.2 < 1.0.2zs Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2zs. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2zs advisory. - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way...

Elasticsearch 8.x < 8.19.21 / 9.0.x < 9.4.6 / 9.5.x < 9.5.3 DoS (ESA-2026-170)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.21, or 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-170 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to...