EUVD-2026-51624

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

Savon::Model evaluates WSDL operation names as Ruby source

Impact Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to moduleeval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .alloperations class method...

CLEANSTART-2026-RC58039 Security fixes in aws-network-policy-agent 1.3.2-r0

Package aws-network-policy-agent version 1.3.2-r0 fixes 1 vulnerabilities: ghsa-xmrv-pmrh-hhx2...

CLEANSTART-2026-YM99936 Security fixes in velero-plugin-for-aws 1.14.0-r1

Package velero-plugin-for-aws version 1.14.0-r1 fixes 8 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-33810, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282...

EUVD-2026-50134

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

CVE-2026-63239 Hard-coded AWS IAM credentials vulnerability

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

CVE-2026-63239

The CVE-2026-63239 entry describes a vulnerability in Koollab LMS where hard-coded AWS IAM credentials are present. This flaw can allow an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email...

PT-2026-65710

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

Microsoft SharePoint - Web Services Discovery Detection

Detected exposed SharePoint web services via /vtibin/spdisco.aspx endpoint !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed SharePoint web services via /vtibin/spdisco.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

CVE-2026-58343

A flaw was found in Moodle. Capability checks were missing from course assistance AI Artificial Intelligence placement web services. This could allow users to make requests to these web services without possessing the necessary permissions, potentially leading to unauthorized access to AI course...

Veeder-Root TLS4B Command Injection (CVE-2025-58428)

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...

Incorrect Calculation

Overview Affected versions of this package are vulnerable to Incorrect Calculation due to the incorrect mapping of the S3LoggingOptions.encrypted property to the CloudFormation S3LogsConfig.EncryptionDisabled field. An attacker can cause build logs to be stored unencrypted by explicitly setting t...

EUVD-2026-41116

AWS CLI: Overly permissive File Permissions...

CVE-2026-16584 AWS API MCP Server Security Policy Bypass via Startup Failure

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary netty-resolver-dns-4.2.13.Final.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-45673, CVE-2026-45674, CVE-2026-47691. Vulnerability Details CVEID:CVE-2026-45673 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior t...

PT-2026-64006

Name of the Vulnerable Software and Affected Versions AWS API MCP Server versions 0.2.13 through 1.3.46 Description Improper handling of an initialization failure during server startup allows an actor to bypass the user-configured security policy. If the data used to enforce the security policy...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Vulnerable to Regular Expression Denial of Service (ReDoS)

Summary spring-core-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41848. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-expression-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

EUVD-2026-47463

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite component: Web Services. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material...