EUVD-2026-69896

In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...

CVE-2026-82958

Eclipse Ditto versions [1.3.0, 3.9.6] are affected by a JSON injection flaw in the ImplicitThingCreationMessageMapper of the connectivity service. When building a CreateThing command, placeholder values resolved from inbound message headers (e.g., MQTT 5 user properties, AMQP 1.0 application prop...

CVE-2026-82958

In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...

CVE-2026-82958

In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...

CVE-2026-82958

In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...

Important: Red Hat Security Advisory: kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_97_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

tutor-lms-methodmap-poc

Tutor LMS ≤ 4.0.5 — Unauthenticated PHP Function Execution via...

my-dshrness-aipentest

DSH PenTest Workflow v4.2 A multi-agent penetration testing w...

Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

The U.S. Department of Justice DoJ has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017. Searzhudin Tamirlanovich Aktulaev , 40, was...

K000163177: Multiple Vim vulnerabilities

Security Advisory Description CVE-2024-41957 Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will als...

-

Nanobot — Modular AI Agent Implementation Implement an open-s...

Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution

Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS. id: CVE-2020-7961 info: name: Liferay Portal Unauthenticated 7.2.1 CE GA2 - Remote Code Execution author: dwisiswant0 severity: critical description: Liferay Portal prior to 7.2.1 ...

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution RCE exploit from one WAGO programmable logic controller PLC to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targetsCVE-2021-31886 , a...

Security update for libgcrypt

This update for libgcrypt fixes the following issue: CVE-2026-41989: crafted ECDH ciphertext can lead denial of service bsc1262684. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

Security update for dovecot22

This update for dovecot22 fixes the following issues: Security issues fixed: CVE-2026-27852: DoS by sending mail with bad header bsc1276799. CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return bsc1276802. CVE-2026-33605: managesieve-login: pre-auth crash bsc1276809...

SUSE-SU-2026:3919-1 Security update for dovecot22

This update for dovecot22 fixes the following issues: Security issues fixed: - CVE-2026-27852: DoS by sending mail with bad header bsc1276799. - CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return bsc1276802. - CVE-2026-33605: managesieve-login: pre-auth crash...

Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

The U.S. Department of Justice DoJ on Tuesday announced the takedown of a long-standing peer-to-peer P2P botnet known as Sality as part of a coordinated law enforcement operation. The effort was undertaken on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania, in...

Cybersecurity-Penetration-Testing-Lab-for-Kioptrix-1-and-Metasploitable-2

Penetration Testing Lab for Kioptrix 1 and Metasploitable 2 A f...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

CVE-2026-6469

A flaw was found in PostgreSQL where the ALTER TABLE ALTER TYPE command incorrectly reassigns ownership of dependent statistics objects to the current user. This grants the table owner unauthorized privileges to execute DROP STATISTICS and ALTER STATISTICS while locking out the legitimate owner...