Improper Handling of Highly Compressed Data (Data Amplification)

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the ZLIB read path in thrift.transport.THeaderTransport.THeaderTransport. An attacker can force excessive memo...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

OPENSUSE-SU-2026:21447-1 Security update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21

This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues: Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: Revert %ghost /usr/bin/go...

SUSE-SU-2026:22950-1 Security update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21

This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues: Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: Revert %ghost /usr/bin/go...

SUSE-SU-2026:22958-1 Security update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21

This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues: Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: Revert %ghost /usr/bin/go...

xss-guide

XSS Cross-Site Scripting Attack Technical Guide: From Principl...

CVE-2026-64452

A flaw was found in the Linux kernel's 6LoWPAN IPv6 over Low-Power Wireless Personal Area Networks component. A race condition in the lowpannhcdouncompression function can lead to a use-after-free vulnerability. This occurs when an NHC Next Header Compression descriptor is deallocated while anoth...

OPENSUSE-SU-2026:21451-1 Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issues: Changes in perl-Mojolicious: - updated to 9.480.0 9.48 - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh random value on every request, instead of being reused for the whole...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-data-commons jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41695, CVE-2026-41711, CVE-2026-41716 and CVE-2026-41721 reported for spring-data-commons-3.4.11.jar, spring-data-commons-3.5.11.jar. Vulnerability Details CVEID:CVE-2026-41695 DESCRIPTION: Spring Data Commons...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-expression jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41850, CVE-2026-41851 and CVE-2026-41852 reported for spring-expression-6.2.12.jar, spring-expression-6.2.18.jar . Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-hateoas jar (CVE-2026-41006, CVE-2026-41007)

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41006 and CVE-2026-41007 reported for spring-hateoas-2.4.1.jar, spring-hateoas-2.5.2.jar . Vulnerability Details CVEID:CVE-2026-41006 DESCRIPTION: Spring HATEOAS's internal PropertyUtils.createObjectFromPropertie...

augustus v0.14.11

Augustus - LLM vulnerability scanner for prompt injection, jailbreak, and adversarial attack testing Augustus - LLM Vulnerability Scanner Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction. Augustus is a Go-bas...

BIT-OPENBAO-2026-39388 OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and disablebinding=true is set, attempts to verify the current request's presented mTLS certificate matches the original. Toke...

BIT-OPENBAO-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...

BIT-OPENBAO-2025-55003 OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao's Login Multi-Factor Authentication MFA system allows enforcing MFA using Time-based One Time Password TOTP. Due to...

BIT-OPENBAO-2025-55001 OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. Whe...

BIT-OPENBAO-2025-54999 OpenBao: Timing Side-Channel in Userpass Auth Method

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

Apache Log4j2 Remote Code Injection

Apache Log4j2 =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when...

Atlassian Confluence Server - Local File Inclusion

Atlassian Confluence Server allows remote attackers to view restricted resources via local file inclusion in the /s/ endpoint. id: CVE-2021-26085 info: name: Atlassian Confluence Server - Local File Inclusion author: princechaddha severity: medium description: Atlassian Confluence Server allows...

Apache Struts2 S2-057 - Remote Code Execution

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution when alwaysSelectFullNamespace is true either by user or a plugin like Convention Plugin and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace...