pomerium v0.33.3

Pomerium is an identity and context-aware reverse proxy. Pomerium builds secure, clientless connections to internal web apps and other services without a corporate VPN. Pomerium is: Easier with clientless access. Faster by being tunnel-free and deployed where your apps and services are. Safer...

org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

EUVD-2026-75573

Dell ThinOS 10, versions prior to 260510.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context...

CVE-2026-15461

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Citrix Netscaler_Application_Delivery_Controller

Citrix NetScaler SAML nFactor Context Authentication Bypass —...

inspector v2.6.0

MCP Inspector A developer tool for inspecting Model Context Protocol MCP servers. It ships as a single package, @modelcontextprotocol/inspector, that provides four ways to inspect a server: Web — a Vite + React + Mantine single-page app with a Node backend. CLI — a scriptable command-line client...

CVE-2026-15461

Zephyr RTOS HL78xx modem GNSS driver contains a type confusion caused by a struct member offset mismatch: struct gnss_nmea0183_match_data was placed as the second member instead of the first, so NMEA parse callbacks read and write state at a shifted offset. The GSV callback reads a bogus pointer ...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

Improper Input Validation

org.springframework.cloud, spring-cloud-context is vulnerable to improper input validation. The vulnerability is due to the absence of property-key allow-list validation, which allows an attacker with access to the writable /actuator/env endpoint to inject or modify arbitrary environment properti...

OpenHarness remote project-context commands allow persistent prompt poisoning

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

PYSEC-2026-3880 OpenHarness remote project-context commands allow persistent prompt poisoning

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

CVE-2026-15461: Access of Resource Using Incompatible Type

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of TrendAI Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Important: containerd

Issue Overview: Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component...

Important: containerd

Issue Overview: Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component...

Important: containerd

Issue Overview: Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-2131)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2131 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function...

Amazon Linux 2 : containerd (ALASDOCKER-2026-140)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-140 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...

Amazon Linux 2 : containerd (ALASECS-2026-136)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-136 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...

Important: containerd

Issue Overview: Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component...