Exploit for CVE-2026-65971

CVE-2026-65971 — SQL Injection in Livewire PowerGrid via sort...

laravel-threat-detection v1.3.1

Laravel Threat Detection Passive intrusion detection for Laravel — see every SQL injection, XSS, scanner, and bot probe hitting your app, logged with full context. It's an IDS, not a WAF: it never blocks, filters, or modifies a request. Drop it into any Laravel 10–13 app and it starts scanning...

CVE-2026-16796

Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)

Last week, there were 91 vulnerabilities disclosed in WordPress Core, 80 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 62 Vulnerability Researchers that contributed to WordPress Security last week. Review those...

CVE-2026-16796

Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...

CVE-2026-16796 Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...

CVE-2026-16796

The vulnerability CVE-2026-16796 affects the AWS Bedrock AgentCore Python SDK install_packages() function; due to improper neutralization of argument delimiters, a remote authenticated user could execute arbitrary commands within the Code Interpreter sandbox when using SDK versions before 1.18.1....

CVE-2026-16796 Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...

CVE-2026-16796 Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

Impact The JDBC spec defines the interface DataSource, with a method called getConnection, and ConnectionPoolDataSource, with a method called getPooledConnection. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated,...

GHSA-W6W4-RJH9-9R58 c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

Impact The JDBC spec defines the interface DataSource, with a method called getConnection, and ConnectionPoolDataSource, with a method called getPooledConnection. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated,...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the RSCErrorHandler when redirect targets from untrusted sources are not properly validated. An attacker can execute arbitrary scripts in the context of the application by supplying a crafted redirect target...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the RSCErrorHandler when redirect targets from untrusted sources are not properly validated. An attacker can execute arbitrary scripts in the context of the application by supplying a crafted redirect target...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the lookup function when handling HTTP/2 requests. An attacker can cause the application to crash by sending specially crafted HTTP method values that exploit inherited object properties, leading to a denial of...

find-my-way: DDoS with HTTP2

Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...

GHSA-C96F-X56V-GQ3H find-my-way: DDoS with HTTP2

Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...

oxo v2.9.13

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-27830 DESCRIPTION: c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances...

Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: A Denia...

openjdk: Enhance Jar file processing (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...