CVE-2026-73654

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPathoperation.key.setnewMetadata, value in...

CVE-2026-17197

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity...

CVE-2026-17220

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

CVE-2026-18164

The CVE concerns Flow Neuroscience FL-100 with an undocumented hard-coded credential that bypasses authentication. The credential is shared across all device units, allowing an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state. Affected component is ...

CVE-2026-18164 Flow Neuroscience FL-100 Use of Hard-coded Credentials

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

EUVD-2026-58274

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-72687 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the...

CVE-2026-73669

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An unauthenticated attacker with network access to the bridge can read device data and control connected lights . ...

CVE-2026-73669 Signify Philips Hue Bridge Pro MQTT broker missing authentication

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in...

CVE-2026-73669 Signify Philips Hue Bridge Pro MQTT broker missing authentication

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in...

EUVD-2026-58238

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-17223

IBM i (7.3–7.6) is affected by CVE-2026-17223 among others. The vulnerability is a buffer overflow that could allow a remote authenticated attacker to execute arbitrary code. Affected: IBM i releases 7.3, 7.4, 7.5, 7.6 on host servers; related issues include DoS and information disclosure in othe...

CVE-2026-16929 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow...

CVE-2026-16929

IBM i is affected by CVE-2026-16929 among multiple host-server vulnerabilities. Affected products and versions: IBM i 7.3–7.6. Description indicates a buffer overflow that could allow a remote authenticated attacker to obtain sensitive information. The IBM security bulletin lists related CVEs and...

CVE-2026-17220

IBM i 7.3–7.6 is affected by CVE-2026-17220, a buffer overflow in host servers that could allow a remote attacker to cause a denial of service and modify authentication metadata. The vulnerability is described in IBM’s Security Bulletin, which lists the affected releases and associated fixes. Rem...

CVE-2026-17220 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

EUVD-2026-58231

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

CVE-2026-17220 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

CVE-2026-17197 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity...

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...