135926 matches found
Security Bulletin: IBM Storage Protect for Space Management is vulnerable to denial of service due to jose4j (CVE-2024-29371)
Summary IBM Storage Protect for Space Management uses the jose4j library as part of its security infrastructure. A vulnerability in jose4j could allow an attacker to cause a denial of service DoS by sending a specially crafted JSON Web Encryption JWE token with an exceptionally high compression...
GHSA-93WV-JW9V-4972 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Summary A remote, unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed,...
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Summary A remote, unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed,...
SUSE CVE-2026-62292
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heifimagehandledecodeimagetile. In...
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Summary @dynatrace-oss/dynatrace-mcp-server v1.8.5 exposes an HTTP transport mode --http flag that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC tools/call request without an...
GHSA-P7W7-4929-VPJ5 `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Summary @dynatrace-oss/dynatrace-mcp-server v1.8.5 exposes an HTTP transport mode --http flag that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC tools/call request without an...
cvelistV5 cve_2026-07-31_1400Z
Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...
abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories
A time-of-check time-of-use TOCTOU race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package...
abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DDOPENREADONLY and calls ddchown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows ...
Security Bulletin: IBM WebSphere Automation is affected by multiple CVEs in the jackson-databind package
Summary IBM WebSphere Automation is affected by multiple CVEs in the jackson-databind package. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8,...
TLS-Scanner v7.0.0-rtc
TLS-Scanner TLS-Scanner is a tool to assist pentesters and security researchers in the evaluation of TLS server and client configurations. Please note: TLS-Scanner is a research tool intended for TLS developers, pentesters, administrators and researchers. There is no GUI. It is in the first versi...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the call process of SelectView due to missing server-side validation of submitted option values. An attacker can execute arbitrary scripts in the context of users' browsers by submitting crafted HTML content,...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption process. An attacker can execute arbitrary JavaScript in the context of users' browsers by supplying crafted input that is rendered without proper sanitization. Details Cross-site scripting or XS...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the SanitizeSvgJob process. An attacker can execute arbitrary JavaScript in the context of the application by replacing an existing SVG attachment with a malicious file containing script payloads. This occurs...
6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization...
CVE-2026-17567
The Fluent Forms β Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for July 2026
Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF001 Vulnerability Details CVEID:CVE-2026-41602 DESCRIPTION: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. User...
ChainHangLow
QNAP Firmware Encryption Key Extraction - CVE Exploitation Gui...
xalgorix v4.5.123
Xalgorix β Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported β so you get proof, not a pile of maybes to triage...
Network Anomaly Detection in KATA
Introduction Once the attacker has breached the corporate network, subsequent stages of the attack often involve leveraging standard domain infrastructure protocols: using Kerberos, running DNS queries, accessing internal services, opening network shares, and other common networking actions...