GitPython: Separate_git_dir Leaks Env Vars Via Crafted .gitmodules Submodule Name

Summary "Repo.clone"'s handling of "separategitdir" never disables "Git.polishurl"'s environment-variable expansion, unlike every other caller of that helper that handles attacker-influenced data. Since "separategitdir" can be derived from an attacker-controlled ".gitmodules" submodule name, a...

CVE-2026-103409

A Missing authentication for critical function vulnerability exists in the Juniper Networks Session Smart Router . An unauthenticated network-based attacker can obtain administrative privileges by passing crafted URL parameters to an insecure endpoint that runs as root . Crucially, this vulnerabi...

EUVD-2026-112212

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can on...

CVE-2026-103409 Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can on...

Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at t...

MGASA-2026-0564 Updated fio package fixes a security vulnerability

A NULL pointer dereference vulnerability exists in fio Flexible I/O Tester v3.41 when parsing job files containing the fdppli option. The callback function strfdpplicb does not validate the input pointer and calls strdup on a NULL value when the option is specified without an argument. This resul...

Updated fio package fixes a security vulnerability

A NULL pointer dereference vulnerability exists in fio Flexible I/O Tester v3.41 when parsing job files containing the fdppli option. The callback function strfdpplicb does not validate the input pointer and calls strdup on a NULL value when the option is specified without an argument. This resul...

Security Bulletin: Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in http-cache-semantics

Summary Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in http-cache-semantics. CVE-2026-93748, CVE-2026-93750 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-93748 DESCRIPTION: http-cache-semantics through 4.2.0 fails to properly...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

GitPython Remote.pull() Refspec Bypasses The --upload-pack Unsafe-option Guard, Enabling Arbitrary Command Execution

Summary "Remote.pull" in GitPython forwards its positional "refspec" argument directly to the "git pull" child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the "refspec" for example a user-supplied branch or refspec...

Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to prototype pollution CVE-2026-2950

Summary lodash is used by the IBM Datapower Operations Dashboard as part of their JavaScript utility library implementation Vulnerability Details CVEID:CVE-2026-2950 DESCRIPTION: The .unset and .omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards...

Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to denial of service attack CVE-2026-50734

Summary Apache is used by the IBM Datapower Operations Dashboard in their Java components utility operations Vulnerability Details CVEID:CVE-2026-50734 DESCRIPTION: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An...

Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to HTTP request smuggling attacks CVE-2026-33870

Summary Netty is used by the IBM Datapower Operations Dashboard as part of their server implementation. Vulnerability Details CVEID:CVE-2026-33870 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty...

Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to denial of service attack CVE-2026-53917

Summary Apache is used by the IBM Datapower Operations Dashboard in their Java components utility operations Vulnerability Details CVEID:CVE-2026-49434 DESCRIPTION: Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access...

Security Bulletin: Multiple vulnerabilities have been found in IBM Guardium Data Protection

Summary Multiple vulnerabilities have been addressed in IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-14456 DESCRIPTION: Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate...

CVE-2026-116587 vulnerabilities

Vulnerabilities for packages: drone-fips, percona-grafana, conftest-fips, xeol, sentry-vroom-fips, krakend, containerd, crossplane-function-kcl, envconsul, gotrue-fips, crossplane-provider-grafana, cloudbeat, crossplane-fips, influxd-fips, cosign, juicefs, temporal-ui-server-fips, plutono-fips,...

CVE-2026-58496

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.0.7, the SFNT/TTF font loader's SfntLoader::gen function in tvgSfntLoader.cpp reads data0 through data3 to identify the font type without first checking that the input buffer contains at least four bytes. Loading...

CVE-2026-116773

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the...

CVE-2026-118375

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdmarecv function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack...

Authlib Accepts An Empty HMAC Key, Allowing JWS/JWT Signature Forgery (HS256/HS384/HS512)

Reporter: Cavan Loughran, Celvex Group Inc. Summary Authlib's symmetric oct key handling accepts an empty key empty bytes b'' / empty string '' as a valid HMAC signing and verification key. An empty HMAC key produces a deterministic digest that any party can reproduce, so an attacker who knows or...