CVE-2026-47837

A flaw was found in Spring Cloud Config Server. This vulnerability allows an unauthenticated remote attacker to send webhook requests to the /monitor endpoint without validation. This lack of authentication for a critical function could lead to a denial of service DoS condition, making the server...

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft...

Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file. Work around: Until a fixed version is deployed, avoid running Checkov over untrusted content, an...

AZL-100917 CVE-2026-83530 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

AZL-100935 CVE-2026-83530 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

The Models That Found 10,000 Zero-Days Broke Into Three Companies Using Weak Passwords

The question of whether a Frontier AI model could find vulnerabilities that no human researcher had found was settled in April. Claude Mythos Preview identified thousands of previously unknown flaws across every major operating system and browser, including a 27-year-old denial-of-service conditi...

MAL-2026-16082 Malicious code in @umschool/platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcf64895a777467cc94763bfb942be3c04040ca151fc22753ca48ac4aaecd69c @umschool/[email protected] is published to public npm under an internal-looking scope with an implausibly high version number, a resolution shape use...

CVE-2026-87821

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

Webinar: Learn How to Answer “Are We Exposed?” Faster After a New CVE

A major vulnerability is disclosed. The alert lands immediately. Then comes the harder question: Are we actually exposed? For many security teams, answering that means jumping between vulnerability scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application data to build...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

EUVD-2026-74847

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821

Lara Dashboard versions 0.9.2 through 1.3.1 are affected by a Server-Side Request Forgery (SSRF) in the POST /api/admin/builder/markdown/fetch endpoint. Any authenticated user can supply a malicious URL without host validation or redirect restrictions , allowing them to read the response body of ...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-79696

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud is using crypto packages which is vulnerable to CVE-2026-32283 and CVE-2026-32281

Summary This release addresses security vulnerabilities in application and operator images of ELM on Hybrid Cloud. The identified vulnerabilities relate to Go standard library packages crypto/tls and crypto/x509, which impact the product within the deployed environment. The vulnerabilities are...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 2.0 have been addressed in version 11.3.1.3-IF4 Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 2.0) is affected by an information disclosure vulnerability due to urllib3

Summary urllib3 is used by IBM Cloud Pak for Data System 2.0 as an HTTP client library for Python applications. When HTTP requests are sent without using proxy support, urllib3 versions prior to 1.26.19 and 2.2.2 do not treat the Proxy-Authorization header as sensitive authentication material and...

CVE-2026-87747 Ragic｜Enterprise Cloud Database - Arbitrary File Read

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

CVE-2026-87747 Ragic｜Enterprise Cloud Database - Arbitrary File Read

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

CVE-2026-87747

Ragic Enterprise Cloud Database is affected by an Arbitrary File Read vulnerability caused by Relative Path Traversal . Privileged remote attackers can exploit this flaw to download arbitrary system files, resulting in high confidentiality impact with no integrity or availability impact. The CVSS...