PT-2026-94186

Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.4 Description On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. This occurs...

PT-2026-95078

Name of the Vulnerable Software and Affected Versions SAIL versions prior to 1.0.0 Description A heap overwrite occurs in the sail codec load frame v8 xbm function within src/sail-codecs/xbm/xbm.c when processing X10 static short files. The issue arises because the decoded pixel buffer is allocat...

Delphi Scanner: Efficient and Interpretable Static Malware Detection Via API Sequence Modeling

Static malware detection for Windows Portable Executable files demands a careful balance between detection effectiveness, computational efficiency, and analytical interpretability. This paper introduces Delphi Scanner, a static malware detection system for Windows PE files that balances efficienc...

Security Bulletin: IBM Informix HQ is affected by multiple security vulnerabilities due to Hono (CVE-2026-54286, CVE-2026-54287, CVE-2026-54288, CVE-2026-54289, CVE-2026-54290).

Summary IBM Informix HQ is affected by multiple vulnerabilities in Hono. To address these vulnerabilities, IBM Informix HQ has been updated to the latest version of Hono. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any...

Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Firewall Adaptive Security Appliance ASA Software, Cisco Secure Firewall Threat Defense FTD Software and Cisco Secure Firewall Management Center FMC Software engineering team has conducted a...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38409)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delStaticDhcpRules function. Attackers can exploit this vulnerability by sending a specially crafted PO...

CVE-2026-76872

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcpaddstaticipcgi, dhcpstaticipshowcgi, ipaclsetcgi, and ipaclshowcgi. Attackers can inject persistent malicious scripts through these components to...

CVE-2026-87289

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

com.buralotech.oss.identifier:buralotech-identifier-helidonmp (>=3.1.0, <=3.1.1), com.open-elements:recordstore-server (>=0.1.0, <=0.10.0) +46 more potentially affected by CVE-2026-87289 via io.helidon.webserver:helidon-webserver-static-content (>=4.0.0-m2, <=4.5.4)

io.helidon.webserver:helidon-webserver-static-content MAVEN version =4.0.0-m2, =3.1.0, =0.1.0, =1.15.0.516, =0.4.0, =1.2-rc4, =0.11, =1.0.0, =1.4.0, =1.0.0, =4.0.0-m2, =4.0.0-m2, =4.0.0-rc2, =4.0.0-m2, =4.5.4 and more Source cves: CVE-2026-87289 Source advisory:...

io.helidon:helidon-all (27.0.0-m1) potentially affected by CVE-2026-87289 via io.helidon.webserver:helidon-webserver-static-content (27.0.0-m1)

io.helidon.webserver:helidon-webserver-static-content MAVEN version 27.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.helidon.webserver:helidon-webserver-static-content and may be impacted: - io.helidon:helidon-all 27.0.0-m1 Source cves:...

CVE-2026-87289

CVE-2026-87289 affects the helidon-webserver-static-content component of Oracle Helidon (Oracle Fusion Middleware), versions 4.0.0 through 4.5.4 . An unauthenticated attacker with network access via HTTP can trigger a hang or frequently repeatable crash, resulting in a complete denial of service ...

EUVD-2026-79938

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

EUVD-2026-78805

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91948 FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91948

FreeRDP versions before 3.31.0 are affected by an out-of-bounds write in the server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. An authenticated client can queue oversized channel messages, causing a buffer underflow that corrupts heap memory including live ...

CVE-2026-91836

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/staticscanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...

CVE-2026-91836

OpenClaw ClawScan versions up to 0.1.6 contain a flaw in the Static Scanner component (file internal/runner/static_scanner.go, unknown function). The vulnerability stems from an incomplete comparison with missing factors , allowing a local attacker with low privileges and user interaction to achi...

CVE-2026-91836 OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/staticscanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...

Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-22745 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an...

PT-2026-93206

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp add staticip cgi, dhcp staticip show cgi, ip acl set cgi, and ip acl show cgi. Attackers can inject persistent malicious scripts through these...