Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Poison Null Byte in Netty (CVE-2026-62380)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Poison Null Byte in Netty, due to null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 client encoders. Netty is used in our Speech microservices. This vulnerability has been addressed. Please read the details for...

CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

CVE-2026-111911

The software phpMyFAQ (versions 4.0.0 before 4.1.9) contains an authentication bypass vulnerability related to its WebAuthn registration endpoints. The root cause is that these endpoints attach credentials to any account without requiring proper authentication or challenge validation. An attacker...

jeopardize

Introducción La herramienta Jeopardize está desarrollada para proporcionar capacidades básicas de inteligencia y respuesta contra amenazas de dominios de phishing al mínimo costo posible. Detecta candidatos a dominios de phishing registrados typosquatting, homógrafos, etc., los analiza y les asig...

onecli

L'agent harness costruito per i team. Un assistente professionale per le aziende. Dai a ogni dipendente un agente personale sicuro e in sandbox. Sito web · Documentazione · Discord Avvio rapido Cloud-hosted: onecli.sh Self-hosted git clone https://github.com/onecli/onecli.git && cd onecli pnpm...

CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-88059

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

onecli v2.0.1

The agent harness built for teams. A pro assistant for companies. Give every employee a secured, sandboxed personal agent. Website · Docs · Discord Quick Start Cloud-hosted: onecli.sh Self-hosted git clone https://github.com/onecli/onecli.git && cd onecli pnpm install pnpm run setup Open...

SUSE CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380

Netty (io.netty:netty-codec-socks) versions 4.1.x through 4.1.136.Final and 4.2.0.Final through 4.2.16.Final contain null byte and CRLF injection vulnerabilities in the Socks4ClientEncoder and Socks5ClientEncoder . The encoders fail to validate domain address and authentication (username/password...

CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

EUVD-2026-64272

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

Linux Distros Unpatched Vulnerability : CVE-2026-62380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection...