Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (CVE-2026-3158)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure Vulnerability Details CVEID:CVE-2026-3158 DESCRIPTION: IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI (CVE-2026-3157)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure in mailbox UI. Vulnerability Details CVEID:CVE-2026-3157 DESCRIPTION: IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through...

Fake listings can turn trusted platforms into scam springboards

Recently, we found a listing on BuzzFeed from someone pretending to be Malwarebytes Support. It reminded us why we need to be cautious about content on platforms where anyone can create an entry. Based on the phone number, we suspect the people behind this listing are trying to draw callers into ...

CVE-2019-25766

A flaw was found in Renovate. During certain Go Modules update failure scenarios, temporary repository tokens are inadvertently leaked into pull request comments. A remote attacker able to view these comments could obtain the exposed tokens, leading to unauthorized access to repositories. This...

Exploit for CVE-2026-18963

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detecto...

SkillSpector v2.10.0

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

wasmtime:wast_tests: Stack-use-after-scope in wast_tests

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=6483688326758400 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: wasttests Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Stack-use-after-scope WRITE 7 Crash...

vlc:vlc-demux-dec-libfuzzer-image: Heap-buffer-overflow in IsJfif

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=6372834669821952 Project: vlc Fuzzing Engine: afl Fuzz Target: vlc-demux-dec-libfuzzer-image Job Type: aflasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x7911a1fe890...

SUSE CVE-2026-72487

In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x8664 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pcigetromsize+0x52/0x220 Call Trace:...

androidReverse v20

Android Reverse A reverse engineering suite that runs entirely on Android. No PC, no ADB, no desktop tools — everything from APK extraction to native binary analysis happens on-device. MCP Server androidReverse includes a built-in Model Context Protocol server, allowing MCP-compatible AI clients ...

PT-2026-82603

openssl encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

PT-2026-82571

Name of the Vulnerable Software and Affected Versions Telnyx MCP server affected versions not specified Description The HTTP transport was exposed on all network interfaces and did not require caller credentials. In the file packages/mcp-server/src/http.ts, the server served the Model Context...

PT-2026-82730

Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description An unauthenticated user can execute arbitrary SQL statements against the underlying database of the ServiceNow AI platform. This occurs via a SQL injection in the dynamic schem...

PT-2026-82733

Name of the Vulnerable Software and Affected Versions Unitree G1 EDU firmware versions prior to 1.5.3 Description Multiple chained issues exist in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials...

PT-2026-82487

Name of the Vulnerable Software and Affected Versions Zbtlink WE1326 firmware 19.1101 Zbtlink WE357 firmware 19.1101 Zbtlink WE5926 firmware 19.1101 Zbtlink WE5926-WD firmware 19.1101 Zbtlink WE826-Q firmware 19.1101 Zbtlink WE826-T2 firmware 19.1101 Zbtlink WE826-WD firmware 19.1101 Zbtlink WG10...

PT-2026-82793

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

PT-2026-82602

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software uses a denylist to identify trusted built-in plugins, which allows unsigned plugins located in top-level plugins/ directories and unknown subdirectories to bypass signature...

PT-2026-82413

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0...

Security update for gh (important)

openSUSE security update: security update for gh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21663-1 Rating: important References: bsc1266618 bsc1276661 bsc1276662 bsc1276663 bsc1276664 Cross-References: CVE-2026-39821 CVE-2026-64652...

Zimbra Collaboration Suite 10.1.19 SMTP Command Injection

Zimbra Collaboration Suite versions prior to 10.1.20 contain an OS command injection vulnerability in the optional zimbra-snmp package when SNMP notifications are enabled. This exploit injects a crafted service status message through an unauthenticated SMTP recipient address, causing the SNMP...