Fiber has a Denial of Service Vulnerability via Route Parameter Overflow

A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during...

Security Bulletin: A vulnerability in IBM Java Runtime affects Tivoli Netcool/OMNIbus ( CVE-2026-1188)

Summary A vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus has been addressed. Vulnerability Details CVEID:CVE-2026-1188 DESCRIPTION: In the Eclipse OMR port library component since release 0.2.0, an API function to return the...

UBUNTU-CVE-2026-2764

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

CVE-2026-2796

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox 148 and Thunderbird 148...

Security update for libxml2

This update for libxml2 fixes the following issues: CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. bsc1256807, bsc1256811 CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to...

CVE-2025-11165

A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine VTools that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl. By dynamically modifying the Velocity engine’s runtime configuration and...

CVE-2025-11165

A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine VTools that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl. By dynamically modifying the Velocity engine’s runtime configuration and...

Wiz Leads the 2026 Latio Application Security Report with awards in 4 categories

Wiz has been recognized in the 2026 Latio Application Security Report. Wiz was spotlighted and awarded four distinct badges, reflecting our continuous commitment to protecting applications all the way from code to runtime...

GO-2026-4517 Kata Container to Guest micro VM privilege escalation in github.com/kata-containers/kata-containers/src/runtime

Kata Container to Guest micro VM privilege escalation in github.com/kata-containers/kata-containers/src/runtime...

CVE-2026-21434 vulnerabilities

Vulnerabilities for packages: ipfs-cluster-fips, spegel, k3s, kubo, rke2-runtime, spegel-fips, ipfs-cluster...

CVE-2026-21438 vulnerabilities

Vulnerabilities for packages: ipfs-cluster-fips, spegel, k3s, kubo, rke2-runtime, spegel-fips, ipfs-cluster...

GHSA-G6X7-JQ8P-6Q9Q vulnerabilities

Vulnerabilities for packages: ipfs-cluster-fips, spegel, k3s, kubo, rke2-runtime, spegel-fips, ipfs-cluster...

CVE-2026-21435 vulnerabilities

Vulnerabilities for packages: ipfs-cluster-fips, spegel, k3s, kubo, rke2-runtime, spegel-fips, ipfs-cluster...

GHSA-PX4R-G4P3-HHQV vulnerabilities

Vulnerabilities for packages: ipfs-cluster-fips, spegel, k3s, kubo, rke2-runtime, spegel-fips, ipfs-cluster...

GHSA-2F2X-8MWP-P2GC vulnerabilities

Vulnerabilities for packages: ipfs-cluster-fips, spegel, k3s, kubo, rke2-runtime, spegel-fips, ipfs-cluster...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime (CVE-2026-21945,CVE-2026-21932,CVE-2026-21933, CVE-2026-21925 & CVE-2026-1188))

Summary IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily exploitable vulnerability issue that allows an remote attacker to cause...

OSV-2026-292 UNKNOWN WRITE in <wasmtime::runtime::func::Func>::call_unchecked_raw::<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486503337 Crash type: UNKNOWN WRITE Crash state: ::calluncheckedraw::::queuecall...

Agentic AI As a Cybersecurity Attack Surface: Threats, Exploits, and Defenses in Runtime Supply Chains

Agentic systems built on large language models LLMs extend beyond text generation to autonomously retrieve information and invoke tools. This runtime execution model shifts the attack surface from build-time artifacts to inference-time dependencies, exposing agents to manipulation through untrust...

CVE-2026-27484

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling timeout, kick, ban uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and...

CVE-2026-27190

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:childprocess implementation. This vulnerability is fixed in 2.6.8...