org.keycloak:keycloak-account-freemarker (1.0-alpha-3), org.keycloak:keycloak-login-freemarker (1.0-alpha-3) +1 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (1.0-alpha-3)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-3 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.0-beta-1-20150523), org.keycloak:keycloak-login-freemarker (1.0-beta-1-20150523) +1 more potentially affected by CVE-2026-1529 via org.keycloak:keycloak-services (1.0-beta-1-20150523)

org.keycloak:keycloak-services MAVEN version 1.0-beta-1-20150523 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-1-20150523 -...

CVE-2026-25230

CVE-2026-25230 affects FileRise, a self-hosted web file manager/WebDAV server. Before version 3.3.0, an authenticated user could inject HTML to modify the DOM, enabling the addition of elements that call certain endpoints or link elements that redirect on interaction. The issue is fixed in 3.3.0....

⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Cyber threats are no longer coming from just malware or exploits. They’re showing up inside the tools, platforms, and ecosystems organizations use every day. As companies connect AI, cloud apps, developer tools, and communication systems, attackers are following those same paths. A clear pattern...

Improper Isolation or Compartmentalization

Overview mcp-run-python is a Model Context Protocol server to run Python code in a sandbox. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization via the runPython or runPythonAsync functions. An attacker can gain unauthorized access to and manipulate the...

firefox: thunderbird: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component...

CVE-2026-2201

A security vulnerability has been detected in ZeroWdd studentmanager up to 2151560fc0a50ec00426785ec1e01a3763b380d9. This impacts the function addLeave of the file src/main/java/com/wdd/studentmanager/controller/LeaveController.java. The manipulation of the argument Reason for Leave leads to cros...

firefox: thunderbird: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component...

CVE-2026-2201

A security vulnerability has been detected in ZeroWdd studentmanager up to 2151560fc0a50ec00426785ec1e01a3763b380d9. This impacts the function addLeave of the file src/main/java/com/wdd/studentmanager/controller/LeaveController.java. The manipulation of the argument Reason for Leave leads to cros...

WAGO Industrial-Managed-Switch 0852-1322 and WAGO Industrial-Managed-Switch 0852-1328 have path traversal vulnerabilities

WAGO Industrial-Managed-Switch 0852-1322 and WAGO Industrial-Managed-Switch 0852-1328 are industrial-grade managed Ethernet switches from the German company WAGO. Both devices have path traversal vulnerabilities, which stem from insufficient URI validation. This vulnerability could allow unverifi...

FileRise security vulnerabilities

FileRise is a lightweight, self-hosted web-based file manager developed by Ryan as an individual developer. Versions of FileRise prior to 3.3.0 contained security vulnerabilities, which were caused by HTML injection, potentially allowing modifications to the DOM or redirecting users...

Exploring Semantic Labeling Strategies for Third-Party Cybersecurity Risk Assessment Questionnaires

Third-Party Risk Assessment TPRA is a core cybersecurity practice for evaluating suppliers against standards such as ISO/IEC 27001 and NIST. TPRA questionnaires are typically drawn from large repositories of security and compliance questions, yet tailoring assessments to organizational needs...

CVE-2026-2180

The CVE-2026-2180 entry affects Tenda RX3 (version 16.03.13.11). A stack-based buffer overflow is triggered in the file path /goform/fast_setting_wifi_set (also reported as /goform/fast setting wifi set) by manipulating the ssid_5g/ssid 5g argument. This vulnerability can be exploited remotely, w...

CVE-2026-2078

A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/updatePermission/deletePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\PermissionController.java of the component...

D-Link DI-7100G command injection vulnerability

The D-Link DI-7100G is a wireless router produced by D-Link Corporation. The D-Link DI-7100G C1 version, released on April 18, 2014, has a command injection vulnerability. This vulnerability stems from improper handling of the parameter “usbusername” when using the setjhttpdinfo function, which m...

Rethinking Latency Denial-Of-Service: Attacking the LLM Serving Framework, Not the Model

Large Language Models face an emerging and critical threat known as latency attacks. Because LLM inference is inherently expensive, even modest slowdowns can translate into substantial operating costs and severe availability risks. Recently, a growing body of research has focused on algorithmic...

CVE-2026-25650

MCP Salesforce Connector is a Model Context Protocol MCP server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10...

MINI-226G-P2PW-3G3C

Bulletin has no description...

CVE-2026-2078 yeqifu warehouse Permission Management PermissionController.java deletePermission improper authorization

A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/updatePermission/deletePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\PermissionController.java of the component...

CVE-2026-2078 yeqifu warehouse Permission Management PermissionController.java deletePermission improper authorization

A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/updatePermission/deletePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\PermissionController.java of the component...