Security Bulletin: Security vulnerability in IBM Java SDK affects WebSphere Service Registry and Repository due to July 2026 CPU (CVE-2026-16440)

Summary Security vulnerability in IBM SDK Java Technology Edition, used by WebSphere Service Registry and Repository has been addressed. This issue is also addressed by WebSphere Application Server shipped with WebSphere Service Registry and Repository. Vulnerability Details CVEID:CVE-2026-16440...

SUSE-SU-2026:4153-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: - CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. - CVE-2026-16243: arraycmp SIMD...

PT-2026-91243

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

Exploit for Out-of-bounds Read in Foxit Pdf_Editor

CVE-2024-30350 Research Notes Overview CVE-2024-30350 is...

GO-2026-6406 SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode) in github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents publish mode in github.com/siyuan-note/siyuan/kernel...

CVE-2026-61911

A flaw was found in cyrus-imapd. An authenticated user could install a Sieve script to determine if another user's private mailbox exists. This is achieved by observing the behavior of the fileinto branch during Local Mail Transfer Protocol LMTP delivery. Additionally, this method could allow the...

Security Bulletin: Vulnerability found in IBM Java affecrting Rational Business Developer

Summary There is a vulnerability in IBM Java used by Rational Business Developer. Rational Business Developer has provided fixes for the applicable CVE. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested...

CVE-2026-71807

The RuoYi-Cloud-Plus software (version

CVE-2026-71807

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

Security Bulletin: A Vulnerability in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU plus deferred CVE-2026-16440

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Merging Cyber Threat Intelligence through Retrieval-Augmented Generation and Small Language Models for Rich Threat Representation

Modern cybersecurity operations rely on CTI collected from heterogeneous sources, including semi-structured threat representations, IoCs, and narrative technical reports. However, these artifacts are often insufficient in isolation to reconstruct how an attack unfolds, under which conditions each...

GHSA-V7PH-R5R6-4JCJ SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72808. Summary The /api/asset/getFileAnnotation endpoint returns the content of .sya PDF-annotation files with no publish-access check. It is gated by CheckAuth only, so it is reachable by the publish RoleReader token and by the anonymous account wh...

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72808. Summary The /api/asset/getFileAnnotation endpoint returns the content of .sya PDF-annotation files with no publish-access check. It is gated by CheckAuth only, so it is reachable by the publish RoleReader token and by the anonymous account wh...

EUVD-2026-57409

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents publish mode...

CVE-2026-77180

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

EUVD-2026-70141

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

CVE-2026-77180 NGINX Ingress Controller vulnerability

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

CVE-2026-77180

NGINX Ingress Controller is vulnerable to a configuration injection flaw (CWE-76) in its configuration generator. Multiple user-controllable Ingress annotation fields are written into the generated NGINX configuration without sanitization , allowing an authenticated attacker with Kubernetes API w...

CVE-2026-77180 NGINX Ingress Controller vulnerability

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...

PT-2026-84762

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...