PT-2026-73230

Three pressures shaped this week's queue. Perimeter and analytics software came under confirmed attack, with three fresh KEV entries carrying remediation deadlines that have already passed. Microsoft shipped one of the largest security releases in its history. PostgreSQL shipped the largest singl...

PT-2026-72143

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress object type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback can process checks only the HTTP method for the push class — no capability or...

SUSE SLES15: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-demo / etc (SUSE-SU-2026:3615-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3615-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycm...

SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2026:3614-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3614-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIM...

SAEFUZZ: Smart Contract Vulnerability Detection through Statically Guided Evolutionary Fuzzing

The effectiveness of smart contract fuzzing depends strongly on whether generated transactions reach deep, state-dependent execution paths. Existing fuzzers often generate highly random call sequences, wasting executions on semantically invalid or low-value states and leaving vulnerabilities that...

PT-2026-72831

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5 IB METHOD DEVX SUBSCRIBE EVENT links event sub into sub list before initializing the fields used by the shared error path. If eventfd ctx fdget then fails, the unwi...

VulnCheck KEV: CVE-2026-19598

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

PT-2026-72712

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

PT-2026-72169

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the SET SPARSE, SET ZERO DATA, and SET COMPRESSION operations use current worker credentials instead of the credentials captured when the SMB handle was opened. This...

Hierarchical Agentic Incident Response with Digital-Twin-Validated Attack Inference

Network incident response remains slow and labor-intensive as the defender must infer multi-stage attacks from partial observations and translate recovery decisions into reliable system commands. Decision-theoretic planners provide principled optimization but typically rely on abstract states and...

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/passw...

GHSA-49MQ-FC6Q-3H46 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/passw...

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM SECURITY ADVISORY First Issued: Fri Aug 14 20:25:19 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/aixviosadvisory.asc Security Bulletin: Vulnerabilities in IBM AIX and PowerVM VIOS...

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...

GHSA-9HGC-G3W5-67CM ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...

GHSA-4X9G-VW65-VVF9 Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Summary An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down. Details Grav::fallbackUrl...

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Summary An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down. Details Grav::fallbackUrl...

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

CVE-2026-73679

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...