CVE-2026-66902: Improper Neutralization of Special Elements used in an OS Command

Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as system$command, a single argument call that passes the whole...

CVE-2026-49131 OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14512, CVE-2026-14528)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14446)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14529)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

K000162741: Ruby on Rails Action Pack vulnerability CVE-2026-66066

Security Advisory Description Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation...

CVE-2026-59913

Dell Display and Peripheral Manager DDPM Mac, versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

Important: Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - thrift

AIPCC Security Alerts identified CVEs in the 3.4 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

CVE-2026-18610

CVE-2026-18610 affects NewType WebEIP up to v3.0, impacting an unknown part of the file /EIP_Com_FileList.aspx. The issue enables improper authentication and can be exploited remotely; the exploit is public. Vendor did not respond to disclosure. No remediation details are provided in the availabl...

JLSEC-2026-1108

A flaw was found in LibRaw. A heap-buffer-overflow in raw2imageex caused by a maliciously crafted file may lead to an application crash...

dvwa-webapp-vapt

dvwa-webapp-vapt Black-box penetration test of D...

EUVD-2026-52263

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

Security Bulletin: IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

Summary IBM Maximo Application Suite uses axios-1.15.2.tgz, protobufjs-8.0.1.tgz, protobufjs-8.2.0.tgz and undici-7.26.0.tgz which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-6734, CVE-2026-9678, CVE-2026-9679, CVE-2026-9697, CVE-2026-54270, CVE-2026-45740,...

WordPress Remote API plugin <= 0.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Pedro Pinho in WordPress Plugin Remote API versions = 0.2...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs

Summary IBM Maximo Application Suite - Predict Component uses aiohttp-3.12.14-cp310-cp310-macosx109universal2.whl which are vulnerable to CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525...

webpen

WebPen — Pentest Pocket Reference A static, in-depth web ap...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506, This bulletin contains information regarding the vulnerability an...

Security Bulletin: There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs

Summary There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs mentioned below. Vulnerability Details CVEID:CVE-2026-48712 DESCRIPTION: protobuf...

Security Bulletin: There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50020)

Summary There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50020 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

Security Bulletin: There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50560)

Summary There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50560 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...