CVE-2026-9327

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

CVE-2026-9327

CVE-2026-9327 affects IBM WebSphere Application Server versions 9.0 (9.0.0.0–9.0.5.28) and 8.5 (8.5.0.0–8.5.5.30). The vulnerability is an improper privilege management flaw (CWE-269) that allows an authenticated user with a low-privilege administrative role to modify security configuration, pote...

EUVD-2026-75733

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

pwndbg

pwndbg pwndbg /paʊnˈdiˌbʌɡ/ is a GDB and LLDB plug-in that makes debugging suck less, with a focus on features needed by low-level software developers, hardware hackers, reverse-engineers and exploit developers. It has a boatload of features, see our Features page and CHEATSHEET feel free to prin...

ansible-collection-hardening

Ansible Collection - devsec.hardening...

mongoaudit

mongoaudit es una herramienta CLI para auditar servidores MongoDB, detectar configuraciones de seguridad deficientes y realizar pruebas de penetración automatizadas. Instalación Clona este repositorio y ejecuta la configuración: se publica bajo la Licencia MIT...

CVE-2026-63295 Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges such as enforcing restricted.containers.privilege=isolated, LXD fails to enforce the...

CVE-2026-7326

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...

EUVD-2026-53421

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...

CVE-2026-7326

The CVE-2026-7326 issue affects Progress MarkLogic Server Admin UI prior to versions 11.3.6 and 12.0.3. It is a cross-site request forgery (CSRF) vulnerability where an attacker lures an authenticated administrator to a malicious page to perform actions on behalf of the admin, potentially causing...

CVE-2026-18631 jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse Jersey-client library that could cause critical SSL/TLS security configurations issues (CVE-2025-12383).

Summary IBM Storage Protect Server uses the Eclipse Jersey-client library in certain components. A vulnerability in Jersey could cause critical SSL/TLS security configurations issues, which may lead to unauthorized trust of insecure or malicious servers, potentially compromising the confidentiali...

PYSEC-2026-1345 Remote Code Execution in Custom Integration Upload

Impact The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox...

EUVD-2026-41509

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS...

CVE-2026-8286 wrong STARTTLS connection reuse

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...

CVE-2026-8286 wrong STARTTLS connection reuse

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SNICheck process. An attacker can gain unauthorized access to protected backends by completing a TLS handshake using a permissive SNI and then sending an HTTP Host header...

CVE-2026-48709 OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not cal...

CVE-2026-48709 OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not cal...

CVE-2026-6277 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with Security Manager-role permissions to manage project security configuration even whe...