Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules fast-uri, postcss, axios, jsonata and body-parser...

CVE-2026-6223 OTP Bypass in Bahçelievler Muncipality's BiHayat App

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

EUVD-2026-72369

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-6223 OTP Bypass in Bahçelievler Muncipality's BiHayat App

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 before 2.3...

CVE-2026-6223

CVE-2026-6223 is a CRITICAL (CVSS 9.4) improper restriction of excessive authentication attempts vulnerability in the Bahçelievler Municipality BiHayat App (versions 2.1.7 through 07092026), allowing an OTP bypass that leads to full authentication bypass. The vector is network-based with no privi...

EUVD-2026-72354

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

Veto v2.3

Veto An open source VirusTotal client for Android Free and open source. Bring your own VirusTotal API key to scan files, links, and installed applications against over 70 engines, built with a Material 3 interface. No accounts, no tracking, no ads. What is Veto? Veto is an Android client for...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver (CVE-2026-39244, CVE-2026-54466 and CVE-2026-54490)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver. Vulnerability Details CVEID:CVE-2026-39244 DESCRIPTION: adm-zip before 0.5.18 is...

Aegis v3.4.3

Aegis Authenticator Aegis Authenticator is a free, secure and open source 2FA app for Android. It aims to provide a secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups. Aegis supports HOTP and...

MAL-2026-16023 Malicious code in base-app-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 385b3732590f10aba4436505fecbd325128919df56f33c060ef3f9f557ead91f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in base-app-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 385b3732590f10aba4436505fecbd325128919df56f33c060ef3f9f557ead91f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to errors in the certificate validation process. This allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to errors in the authentication process. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...

CVE-2026-86492: Exposure of Data Element to Wrong Session

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86490: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...

PT-2026-86864

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86347: Missing Authorization

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

PT-2026-86862

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...

The vulnerability of the software for providing secure remote access to data in Palo Alto Networks’ GlobalProtect App is related to synchronization errors when using a common resource. This allows attackers to elevate their privileges to the root level.

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App lies in the use of an unreliable search path, allowing attackers to escalate their privileges.

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to the use of an unreliable search path. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the Pre-Logon Access Provider (PLAP) component of the software for secure remote access to data in the Palo Alto Networks GlobalProtect App allows a perpetrator to execute arbitrary code.

The vulnerability of the Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect App, which enables secure remote access to data, is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with SYSTEM privilege...