CVE-2026-4034

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

EUVD-2026-88813

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

CVE-2026-4034

An injection vulnerability exists in TIBCO Administrator version 5.13.0 and prior . This flaw allows an authenticated user to submit specially crafted input through the web-based administration console . The vulnerability carries a High base severity score of 8.7 , with potential impacts on confi...

CVE-2026-4034 TIBCO Administrator Injection Vulnerability

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

CVE-2026-4034 TIBCO Administrator Injection Vulnerability

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

TIBCO Security Advisory: September 29, 2026 - TIBCO Administrator - CVE-2026-4034

TIBCO Administrator Injection Vulnerability Original release date: September 29, 2026 Last revised: --- CVE-2026-4034 Source: TIBCO Software Inc. Description Multiple Injection vulnerability has been discovered in TIBCO Administrator. Refer below for further details Products Affected TIBCO...

CVE-2026-18747

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

CVE-2026-18747: Out-of-bounds Read

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

CVE-2026-4034: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

CVE-2026-100299: Use of Weak Credentials

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption...

PT-2026-102611

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

PT-2026-102888

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption...

CVE-2026-18747

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

CVE-2026-18747 Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

EUVD-2026-88575

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +197 more potentially affected by CVE-2026-102266 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =3.8.0, =3.9.3 and...

360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +197 more potentially affected by CVE-2026-102271 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =3.8.0, =3.9.3 and...

CVE-2026-96740

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer...

EUVD-2026-88379

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...