CVE-2026-21655 C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM WebSphere Application Server and WebSphere Application Server Liberty shipped with IBM WebSphere Remote Server

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM WebSphere Application Server and WebSphere Application Server Liberty have been published in a security bulletin...

React Router: Open redirect leading to XSS

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors...

Appriss Insights VINE Application SQL Injection

RISK EVALUATION The Appriss Insights Equifax VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database. 2...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway Desktop Edition due to the use of IBM WebSphere Application Server Liberty, IBM WebSphere Application Server and Jackson Databind. The versions of IBM WebSphere Application Server Liberty, IBM WebSphere Application Serve...

PYSEC-2026-3515 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

openjdk: Enhance Dataview Implementation (Oracle CPU 2026-07)

A flaw was found in OpenJDK. 1 DataView getter/setter methods use absolute ByteBuffer indexing and ignore the offset, allowing read and write to memory outside its intended window. 2 Missing bounds check in the DataView constructor fails to validate the capacity...

glibc security update

An update is available for glibc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The glibc packages provide the standard C libraries libc, POSIX thread librarie...

Johnson Controls C-CURE 9000 and Victor application server

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds...

[SECURITY] Fedora 44 Update: nginx-mod-naxsi-1.6-21.fc44

naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

PT-2026-64042

Name of the Vulnerable Software and Affected Versions ManageEngine ADAudit Plus versions prior to 8606 Description Unauthenticated remote code execution is possible due to a flaw in the agent API. Recommendations Update ManageEngine ADAudit Plus to version 8606 or later...

PT-2026-64169

Name of the Vulnerable Software and Affected Versions Johnson Controls CCure 9000 and victor application server versions 2.9 through 3.0 Description A Server Side Request Forgery SSRF issue exists in the Victor application server. SSRF is a flaw that allows an attacker to induce the server-side...

PT-2026-64006

Name of the Vulnerable Software and Affected Versions AWS API MCP Server versions 0.2.13 through 1.3.46 Description Improper handling of an initialization failure during server startup allows an actor to bypass the user-configured security policy. If the data used to enforce the security policy...

PT-2026-64177

Name of the Vulnerable Software and Affected Versions MZ Automation libIEC61850 affected versions not specified Description A NULL pointer dereference occurs in the L2 GOOSE and R-GOOSE shared parser. This issue allows a network-adjacent attacker to crash a subscribing application by sending a...

Oracle E-Business Suite (July 2026 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Internal Operations. Supported versions that are...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

GO-2026-6034 Gitea: Privilege Escalation via Access Token Scope Escalation in API in gitea.dev

Gitea: Privilege Escalation via Access Token Scope Escalation in API in gitea.dev...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...