Security Bulletin: IBM MQ queue manager is vulnerable to information disclosure and denial of service (CVE-2026-11726)

Summary IBM MQ has addressed an out-of-bounds memory read and write vulnerability in the queue manager's message conversion handling that could allow a remote authenticated attacker to obtain sensitive information from heap memory or cause a denial of service Vulnerability Details...

Security Bulletin: IBM MQ REST API and Console is vulnerable to multiple security issues

Summary IBM MQ has addressed multiple vulnerabilities in the axios HTTP client library used by the IBM MQ REST API and Console Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.27 and 13.5.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

EUVD-2026-77355

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...

CVE-2026-68570

Apache Doris is affected by an Incorrect Authorization vulnerability that allows an authenticated user to bypass privilege checks and read data they are not authorized to access, resulting in unauthorized information disclosure . Affected versions span 2.0.0 through 2.1.* , 3.0.0 through 3.0.* , ...

CVE-2026-68570 Apache Doris: Authorization bypass leading to unauthorized data access

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...

CVE-2026-68570 Apache Doris: Authorization bypass leading to unauthorized data access

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...

CVE-2026-72524

CVE-2026-72524 is an Incorrect Authorization vulnerability in Apache Doris that allows an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables . The affected versions are 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The vulner...

CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

EUVD-2026-77353

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

CVE-2026-90895 MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did...

CVE-2026-90895

MISP's interactive CLI shell (versions ≤2.5.45) implemented access control independently from the main web application, creating several authorization bypass gaps. Feed listings skipped lookup_visible restrictions for non-host-organisation users, feed detail access bypassed host-organisation/site...

EUVD-2026-77344

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did...

CVE-2026-90895 MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did...

CVE-2026-90895 MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did...

CVE-2025-53072-CVE-2025-62481

CVE-2025-53072 & CVE-2025-62481 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. How does this detection method work? This Nuclei template detects Oracle E-Business Suite instances vulnerable to CVE-2025-53072 and CVE-2025-62481 by...

CVE-2025-55449

CVE-2025-55449 - Vulnerabilidad de Ejecución Remota de Código RCE en AstrBot Resumen Este repositorio contiene un exploit de prueba de concepto para CVE-2025-55449 , una vulnerabilidad crítica de Ejecución Remota de Código RCE en AstrBot. La vulnerabilidad permite a un atacante ejecutar código...

WebGoat v2026.3

WebGoat: A deliberately insecure Web Application Introduction WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. This program is a demonstration of common server-side application flaws. The exercises are intended to be used b...

CVE-2026-90697

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...