CVE-2026-56748

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

CVE-2026-56748

Cribl Stream (before 4.18.2) is affected by an improper validation of symbolic links in the Pack Git import feature. A remote authenticated attacker with Pack import and pipeline preview permissions can trigger arbitrary code execution as the Cribl server process by delivering a crafted Git repos...

CVE-2026-56748 Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

CVE-2026-56748 Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

EUVD-2026-49570

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

CVE-2026-56747

Cribl Stream before 4.18.2 is affected by an improper control of code generation in the JSON Pointer-to-accessor compiler. The vulnerability allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pa...

EUVD-2026-49567

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

PT-2026-65105

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

PT-2026-65104

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

CVE-2026-56748: UNIX Symbolic Link (Symlink) Following

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

CVE-2026-56747: Improper Control of Generation of Code

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

IBM DB2 Remote Code Execution (7279479) (Windows)

According to its self-reported version number, IBM Db2 is affected by a remote code execution vulnerability: - IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CVE-2026-9762 Note that Nessus has not tested for this issue but has...

CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962: Deserialization of Untrusted Data

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

EUVD-2026-48724

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0...

CVE-2026-48033

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0...

GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

Summary GitPython's checkunsafeoptions guard the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since can be bypassed for every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by smuggling an option token inside the VALUE of a single-character...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 (CVE-2026-11897)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details CVEID:CVE-2026-11897 DESCRIPTION: IBM WebSphere Application Server Liberty is...

SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3156-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3156-1 advisory. The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: -...

PT-2026-71453

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54 Description A remote code execution issue exists in the check unsafe options guard. This guard can be bypassed by smuggling git options within single-character kwarg values. An attacker can provide crafted...