Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses IBM WebSphere Application Server Liberty , gnupg2 2.2.20-3.el86, platform-python 3.9.20-1.module+el8.10.0+22342+478c159e, platform-python 50.3.2-6.module+el8.10.0+22183+c898c0c1 , libarchive 3.5.3-9.el97 , platform-python...

CVE-2026-120596

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP...

CVE-2026-120596 CVE-2026-120596

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP...

CVE-2026-120596

A remotely exploitable denial-of-service (DoS) vulnerability exists in the Nut/Net TCP/IP stack within Nut/OS (developed by Ethernut/Egnite), affecting releases up to version 5.1 . An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zer...

CVE-2026-120596 CVE-2026-120596

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP...

CVE-2026-120492 Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowedurls entries because validatemcpurl does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing...

CVE-2026-120492

Chainlit version 2.12.0 is vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause is that the validate_mcp_url function fails to reject the semicolon (;) character . Unauthenticated attackers can submit MCP URLs containing ..; segments to the /mcp endpoint. This allows them to by...

CVE-2026-120492 Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowedurls entries because validatemcpurl does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing...

CVE-2026-99186

A flaw was found in the Linux kernel's x86 instruction evaluation component. A local user can exploit this vulnerability to cause a Denial of Service DoS by executing instructions with segment register overrides that trigger an infinite loop during instruction decoding. This condition traps the...

CVE-2026-117518 @fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its...

CVE-2026-117518 @fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its...

CVE-2026-117518 @fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its...

CVE-2026-117518

The @fastify/reply-from Fastify plugin (versions up to and including 12.8.0 ) is vulnerable to a path traversal issue. The plugin fails to account for backslash dot-segments during path validation, as the WHATWG URL parser normalizes backslashes (and their percent-encoded forms) to forward slashe...

PT-2026-135540

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP...

CVE-2024-22243

CVE-2024-22243 Author: Sean Pesce This project contains an example web application that demonstrates exploitable scenarios for CVE-2024-22243, a URL-parsing vulnerability in the Java Spring Framework official disclosure here. Vulnerability Affected versions of Spring parse the "userinfo" segment ...

pgm-attack

PGM-attack Overview Official code for our paper, Poisoning Attacks on the PGM-index. Quick Start 1. Clone and submodules git clone REPOSITORY LINK cd pgm-index-poisoning git submodule update --init --recursive 2. Build ./scripts/build.sh Requires CMake see Dependencies. Outputs go under build/...

EUVD-2026-114115

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing...

CVE-2026-119710 PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing...

CVE-2026-119425

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119425 OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...