CVE-2026-8400

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

PT-2026-72112

Name of the Vulnerable Software and Affected Versions PAX Technology Q80 affected versions not specified Description A flaw in the parsing of AIP files allows network-adjacent attackers to execute arbitrary code without authentication. By creating a symbolic link, an attacker can abuse the...

(0Day) PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abus...

CVE-2026-8400: Use of Externally-Controlled Input to Select Classes or Code

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

Security Bulletin: Multiple vulnerabilities have been identified in IBM® SDK, Java™ Technology Edition, an IBM Websphere (WAS) prerequisite. WAS is used by IBM Rational ClearQuest

Summary IBM® SDK, Java™ Technology Edition is a prerequisite in order to use IBM WebSphere Application ServerWAS. WAS is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM® SDK, Java™ Technology Edition have been published in a security bulletin...

Schneider Electric Modicon Controllers M241, M251, M258, and LMC058 Improper Neutralization of Input During Web Page Generation (CVE-2025-13902)

CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause condition where authenticated attackers can have a victim's browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server...

CVE-2026-64438

A flaw was found in the Linux kernel's crypto QAT QuickAssist Technology module. A race condition exists during the teardown of Virtual Function to Physical Function VF2PF work in the adfdisablesriov function. This allows a concurrently scheduled or already queued worker to attempt to access memo...

wappalyzergo v0.2.92

Wappalyzergo A high performance port of the Wappalyzer Technology Detection Library to Go. Inspired by Webanalyze. Uses data from https://github.com/enthec/webappanalyzer https://github.com/HTTPArchive/wappalyzer Features Very simple and easy to use, with clean codebase. Normalized regexes +...

USN-8620-3 linux-intel-iot-realtime, linux-intel-iotg-5.15 vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

Beyond Resilience: Antifragility in Critical Infrastructure Cybersecurity

Critical infrastructure cybersecurity increasingly requires frameworks that move beyond recovery toward bounded improvement under disruption, yet empirically grounded theories for operational technology remain limited. This paper develops a Theory of Antifragility AFT for critical infrastructure ...

Read This Before You Buy That TV Streaming Stick

Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices als...

CVE-2026-5219

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...

EUVD-2026-51126

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: through 30072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-5219

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...

A Civilian Plane Crashed in New Mexico. Was the Military’s Tech to Blame?

Drone warfare is making the skies more dangerous, even for airplanes far from the battlefield...

wappalyzergo v0.2.91

Wappalyzergo A high performance port of the Wappalyzer Technology Detection Library to Go. Inspired by Webanalyze. Uses data from https://github.com/enthec/webappanalyzer https://github.com/HTTPArchive/wappalyzer Features Very simple and easy to use, with clean codebase. Normalized regexes +...

PT-2026-66472

Name of the Vulnerable Software and Affected Versions E-Commerce Pack versions prior to 5.03.01.49 Description A Cross-Site Request Forgery CSRF flaw exists in the software. CSRF is a type of attack that tricks a victim into submitting a malicious request. It allows an attacker to perform...

CVE-2026-64533

A flaw was found in the Linux kernel's ntfs3 filesystem driver. A local attacker could exploit this vulnerability by crafting a specially designed NTFS filesystem image. This flaw allows an attacker to cause an out-of-bounds memory write during the log replay conversion process, potentially leadi...

CVE-2026-14171 ads-tec Industrial IT: Post-login open redirect in the web interface

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...

CVE-2026-14168 ads-tec Industrial IT: Vertical privilege escalation via configuration table write

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...