Malware in discord-resolvers

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-100866

A flaw was found in onefetch. An attacker can manipulate terminal output by embedding control characters and escape sequences into project manifest fields, such as the project name or version. When a user runs onefetch in an untrusted repository, these unsanitized values are printed directly to t...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK (August 2026) affect IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK security updates in August 2026. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION:...

EUVD-2026-88048

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...

CVE

Control Tower Notification Enabler Este paquete cdk instala una función Lambda, con un rol IAM asociado, y suscribe la función Lambda a las notificaciones de seguridad agregadas de Control Tower. En caso de una violación de una regla de Control Tower por ejemplo, un bucket S3 de acceso público, l...

PT-2026-99856

Name of the Vulnerable Software and Affected Versions Thinkware U3000 versions prior to 1.02.04 Description Improper access controls exist within the TCP Service component. A remote attacker can manipulate the get file function associated with the /tmp/wpa supplicant.conf file to gain unauthorize...

Continuous Assurance of Agentic Security Auditors for Software Delivery Decision Gates

Large language model LLM-based repository auditors are increasingly deployed as security controls within continuous integration CI pipelines, where their findings admit, block, or delay software changes. As Agentic Software Development Life Cycle SDLC Security Controls, their non-deterministic...

CVE-2026-54674: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-54160: Inclusion of Functionality from Untrusted Control Sphere

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

CVE-2026-101891: Improper Access Control

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-80358: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80357: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80359: On-Chip Debug and Test Interface With Improper Access Control

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-12265: Improper Access Control

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-101054: Improper Access Control

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function getfile of the file /tmp/wpasupplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available...

PT-2026-99902

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

PT-2026-99885

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...

PT-2026-99873

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description Insufficient access control in the HA failover endpoint allows for destructive PostgreSQL database operations, which can lead to complete data destruction. Recommendations Update...

PT-2026-99911

Name of the Vulnerable Software and Affected Versions Dell Boot Optimized Server Storage BOSS versions prior to 2.2.13.2038 Description The SMCU on 17G BOSS-N1 controllers contains an On-Chip Debug and Test Interface with improper access control. An unauthenticated attacker with physical access t...

CVE-2026-102334: Improper Restriction of Excessive Authentication Attempts

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...