Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-44431, CVE-2026-44432)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-44431 DESCRIPTION: urllib3 is an HTTP client...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-39373 DESCRIPTION: JWCrypto implements JWK, JWS...

CVE-2026-13601

creationtimestamp| type| source ---|---|--- 2026-06-29 12:00:34+00:00| seen| https://infosec.exchange/users/offseq/statuses/116833283825806725 2026-06-29 12:00:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpggufewex2l 2026-06-29 12:07:59+00:00| seen|...

236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers

New findings unearthed by Infoblox show that more than 236,000 websites are using investment scam templates built using a legitimate Chinese open-source, cross-platform application development framework called DCloud Uni-App. The templates power bogus cryptocurrency exchanges, multi-language...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2026-44727 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2026-44727 Source advisory: OSV:PYSEC-2026-366...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33057 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33057 Source advisory: OSV:PYSEC-2026-412...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33057 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33057 Source advisory: SNYK:PYTHON-MESOP-17751643...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33054 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33054 Source advisory: OSV:PYSEC-2026-411...

cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-1728 via gradio (1.7.7)

gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-1728 Source advisory: OSV:PYSEC-2026-345...

PyTorch Lightning path traversal vulnerability

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection (CVE-2026-3602)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection. Vulnerability Details CVEID:CVE-2026-3602 DESCRIPTION: IBM App Connect Enterprise is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Bouncy Castle (CVE-2026-0636,CVE-2026-5598,CVE-2026-5588&CVE-2026-3505)

Summary IBM App Connect Enterprise Toolkit and Runtime are vulnerable to multiple vulnerabilities due to Bouncy Castle. Vulnerability Details CVEID:CVE-2026-0636 DESCRIPTION: Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Legion of the Bouncy...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Out-of-bounds Write and unexpected writes due to Node.js module uuid (CVE-2026-41907 & CVE-2026-41988)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to Out-of-bounds Write and unexpected writes due to Node.js module uuid. Vulnerability Details CVEID:CVE-2026-41907...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Apache HttpClient and Apache Neethi ( CVE-2026-40542, CVE-2026-42402, CVE-2026-42403 & CVE-2026-42404 )

Summary IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Apache HttpClient and Apache Neethi. Vulnerability Details CVEID:CVE-2026-40542 DESCRIPTION: Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept...

Malicious code in pino-debugging (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83f0ecc81a618444e701cf5302ced1fa1e92aadc8df2ae2821d2a94a30683d9d Package name 'pino-debugging' is a single-edit typosquat of the legitimate 'pino-debug'. The shipped index.js requires a dependency named 'loadutils'...

MAL-2026-6575 Malicious code in @ibrahim1337/baksen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4 Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers Chrome, Brave, Edge, Opera, Opera GX on the...

Malicious code in @ibrahim1337/baksen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4 Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers Chrome, Brave, Edge, Opera, Opera GX on the...

CVE-2026-13522

creationtimestamp| type| source ---|---|--- 2026-06-29 04:48:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfopxvc3b2o...

EUVD-2026-40011

A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform...

Maestro 0.17.2

Maestro is a cross-platform desktop app for orchestrating your fleet of AI agents and projects. It's a high-velocity solution for hackers who are juggling multiple projects in parallel. Designed for power users who live on the keyboard and rarely touch the mouse. Collaborate with AI to create...