CVE-2026-114403

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

CVE-2026-114403

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

EUVD-2026-107178

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a C...

CLEANSTART-2026-NB05641 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

CVE-2025-61727 affects multiple packages. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

EUVD-2026-106003

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Supply Chain Relationship Mgmt. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

PT-2026-120537

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a C...

CVE-2026-101713

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Application Server. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks...

CVE-2026-101595

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Supply Chain Relationship Mgmt. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

iOS安全攻防研究

现代 iOS 纵深防御体系系列研究笔记：SPTM/TXM/Exclaves 架构、沙箱逃逸攻防、Coruna 与 DarkSword 漏洞链、WebKit 到内核提权、OTA 固件更新安全、后台驻留与持久化检测。内容为防御性研究与公开资料整理。...

Malicious code in rootaccessxvv-bbmarker (npm)

Source: amazon-inspector 126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02 package.json declares a postinstall lifecycle script that runs on npm install and POSTs installer host identifiers to a hardcoded webhook.site collector at...

CVE-2026-101713

A vulnerability exists in the Oracle Agile PLM product (Application Server component) affecting version 9.3.6 . A low-privileged attacker with network access via HTTP can exploit this issue to compromise the system, though the attack requires human interaction . Successful exploitation may result...

CVE-2026-101595

A vulnerability exists in the Oracle Agile Product Lifecycle Management for Process product, specifically within the Supply Chain Relationship Mgmt component in version 6.2.4 . A low-privileged attacker with network access via HTTP can exploit this issue to compromise the system, though successfu...

Resources Downloaded over Insecure Protocol

Overview Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol via the seed wheel acquisition logic in src/virtualenv/seed/wheels/acquire.py and pipinvoke.py, where wheels are cached and later reused without verifying their integrity before being passed t...

MAL-2026-18108 Malicious code in rootaccessxvv-bbmarker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02 package.json declares a postinstall lifecycle script that runs on npm install and POSTs installer host identifiers to a hardcoded webhook.site...

CVE-2026-113666

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer...

EUVD-2026-105129

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the NXCRYPTOMAXRSAMODULUSSIZE default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope...

Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued...

CLEANSTART-2026-LW85415 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Security vulnerability affects the grafana-fips package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...

CLEANSTART-2026-YI31362 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Security vulnerability affects the grafana-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions...

Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain

Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demonstrate that a single malicious package can have wide reaching and devastating impacts overnight. These...