github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

PT-2026-89621

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery...

PT-2026-89491

🚨 CRITICAL: CVE-2026-52098 CVSS 9.8 - Remote Code Execution in Flowise 3.1.2 via /api/v1/prediction endpoint. No authentication required. Patch immediately. CVE Vulnerability PatchNow ThreatIntel https://t.co/nNatq99smh...

CVE-2026-2310: XML Injection (aka Blind XPath Injection)

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

The vulnerability of the ZstdDictCompress component in the zstd-jni data compression library allows a attacker to execute arbitrary code.

The vulnerability of the ZstdDictCompress component in the zstd-jni data compression library is related to reading data outside of the allowed range in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20260910-73-0104

The vulnerability in Chromium is related to information representation errors in the user interface. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

ROS-20260910-73-0080

The vulnerability of the FileSystem component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a remote attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260910-73-0076

The vulnerability of Google Chrome and Microsoft Edge web browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

CVE-2026-65639: Improper Neutralization of Special Elements used in an OS Command

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

PT-2026-89613

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

PT-2026-89602

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

CVE-2026-88287: Stack-based Buffer Overflow

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process...

PT-2026-89648

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

PT-2026-89617

🚨 CVE-2026-79724 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command. 🎖@cveNotify...

CVE-2026-52097

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, afLaunchLocalUri urllauncher.dart, OpenFilex.open, localPathRegex commonpatterns.dart components...

ROS-20260910-73-0057

The vulnerability in Chromium is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to circumvent existing security restrictions...

CVE-2026-78573: Use of Default Credentials

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

PT-2026-89618

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

PT-2026-89625

🚨Critical - IBM Langflow OSS Graph Construction Code Injection CVE-2026-81204 IBM Langflow OSS graph construction accepts attacker-controlled node/graph definitions that can inject code during graph build due to missing execution guards and incomplete security controls. Remote exploitation enable...

PT-2026-89578

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality cou...