CVE-2026-10672

subsys/net/lib/lwm2m/lwm2mpullcontext.c copied the firmware-update Package URI into a fixed static buffer context.uri, size CONFIGLWM2MSWMGMTPACKAGEURILEN, default 128 with memcpycontext.uri, uri, LWM2MPACKAGEURILEN, copying exactly the destination size with no length validation. The...

CVE-2026-10672 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

subsys/net/lib/lwm2m/lwm2mpullcontext.c copied the firmware-update Package URI into a fixed static buffer context.uri, size CONFIGLWM2MSWMGMTPACKAGEURILEN, default 128 with memcpycontext.uri, uri, LWM2MPACKAGEURILEN, copying exactly the destination size with no length validation. The...

Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway Desktop Edition due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, SnakeYAML, Spring Beans, Logback Classic and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring...

MINI-FMRQ-757Q-R4WF

Bulletin has no description...

MINI-XQ9V-VPVJ-83V7

Bulletin has no description...

SUSE-SU-2026:2977-1 Security update for afterburn

This update for afterburn fixes the following issues Update to version 5.10.0.git73.b97f772. Security issues fixed: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270175. - CVE-2026-41677: openssl: out-of-bounds read in PEM password...

PT-2026-58798

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Description An improper encoding or escaping of output issue allows for arbitrary code execution in the context of the current user. This flaw can be exploited without requiring any user...

PT-2026-58688

Name of the Vulnerable Software and Affected Versions Audition affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution within the context of the current user. This occurs when a user opens a specially crafted malicious file,...

PT-2026-58819

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An incorrect authorization issue allows for arbitrary code execution within the context of the current user. This flaw can be exploited without requiring any user interaction...

PT-2026-58838

Name of the Vulnerable Software and Affected Versions Adobe Illustrator affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution within the context of the current user. This occurs when a user opens a specially crafted malicious fil...

PT-2026-58813

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description ColdFusion contains a path traversal issue caused by improper limitation of a pathname to a restricted directory. This flaw allows a remote attacker to execute arbitrary code in the contex...

PT-2026-58788

Name of the Vulnerable Software and Affected Versions Adobe Bridge affected versions not specified Description An integer overflow or wraparound occurs when an application attempts to create a value that exceeds the maximum size of the integer type used to store it. This issue allows for arbitrar...

PT-2026-58705

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description Adobe Experience Manager contains a Server-Side Request Forgery SSRF flaw, which occurs when a server is tricked into making requests to an unintended location. This issue...

PT-2026-58811

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An improper input validation issue allows a remote attacker to execute arbitrary code in the context of the current user without requiring any user interaction. Recommendations At the...

PT-2026-58787

Name of the Vulnerable Software and Affected Versions Adobe Bridge affected versions not specified Description An out-of-bounds write flaw exists that could allow arbitrary code execution in the context of the current user. This occurs when a victim opens a malicious file, meaning user interactio...

Decidim: JWT-backed authentication can be replayed across organizations

Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...

PYSEC-2026-2443 dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens Summary The local OAuth helper FastAPI server bundled with dbt-mcp exposes the GET /dbtplatformcontext endpoint without any form of authentication or host-origin validation. After a user completes the OAuth login flow against dbt...

PYSEC-2026-2860 pdfkit: Path traversal in from_string

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

PYSEC-2026-2514 hermes-agent has an Injection issue

A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function scancontextcontent of the file agent/promptbuilder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The...