CVE-2025-13691

CVE-2025-13691 affects IBM DataStage on Cloud Pak for Data versions 5.1.2–5.3.0. The issue arises from HTTP processing that returns sensitive information in responses, which could be used to impersonate other users. IBM’s bulletin cites CVSS v3.1 base score 8.1 (high) with impact on confidentiali...

PT-2026-20212

URGENT: Ubuntu 24.04 LTS kernel updates USN-8028-3 are live. Critical patches for AMD CPU data leaks CVE-2024-36351 and SEV-SNP guest memory overwrite flaws. Read more: 👉 https://t.co/ChC0mzFiGU Security https://t.co/LSj2IFaKnN...

HPE Aruba Networking 5G Core server API 安全漏洞

The HPE Aruba Networking 5G Core Server API is a programming and management interface provided by the American company HPE. There are security vulnerabilities associated with the HPE Aruba Networking 5G Core Server API. These vulnerabilities stem from improper handling of API errors, which may...

CVE-2026-20638

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3. A user with Live Caller ID app extensions turned off could have identifying information leaked to the extensions...

CVE-2026-24894 FrankenPHP leaks session data between requests in worker mode

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $SESSION data of the previous request potential...

CVE-2025-52533

Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity...

FrankenPHP leaks session data between requests in worker mode

Summary When running FrankenPHP in worker mode, the $SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $SESSION data of the previous request potentially belonging to a different user before sessionstart is...

CVE-2026-20638

CVE-2026-20638 affects iOS and iPadOS. A logic issue allowed identifying information to leak to Live Caller ID app extensions when those extensions were disabled by the user. Apple fixed this in iOS 26.3 and iPadOS 26.3 by applying improved checks. The vulnerability is described as a logic/contro...

CVE-2024-26478

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint...

CVE-2026-1603

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data...

CVE-2025-13651

Technical details describing affected components, vulnerable functions, or remediation are not publicly provided in the supplied documents. Monitor for updates from vendors and public advisories.

USN-8020-1 libsoup3 vulnerabilities

It was discovered that libsoup did not correctly handle certain URL-decoded input, which could allow for HTTP header injection. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-1467, CVE-2026-1536 It was discovered that libsoup did n...

CVE-2025-10258

Infinera DNA is vulnerable to a time-based SQL injection vulnerability due to insufficient input validation, which may result in leaking of sensitive information...

PT-2026-6725

Name of the Vulnerable Software and Affected Versions D-Link DIR-605L version 2.06B01 D-Link DIR-619L version 2.06B01 D-Link DIR-605L version 2.13B01 D-Link DIR-619L version 2.13B01 Description A security issue has been identified in D-Link DIR-605L and DIR-619L routers. The issue resides in an...

IBM webMethods Integration 安全漏洞

IBM webMethods Integration is a hybrid enterprise iPaaS offered by International Business Machines IBM. There are security vulnerabilities in the versions of IBM webMethods Integration 10.15 up to IS10.15CoreFix2411.1 and IS11.1CoreFix8. These vulnerabilities stem from the possibility of sensitiv...

CVE-2026-25536

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

CVE-2026-25536 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

EUVD-2026-5335

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

CVE-2026-25536

CVE-2026-25536 affects the MCP TypeScript SDK. From versions 1.10.0 through 1.25.3, cross‑client data can leak when a single McpServer/Server and transport instance is reused across multiple client connections (notably in stateless StreamableHTTPServerTransport deployments). The issue arises from...

UFIDA U8 Cloud suffers from SQL injection vulnerability (CNVD-C-2026-72551)

U8 Cloud is a new-generation cloud ERP Enterprise Resource Planning solution launched by UFIDA, mainly for growing and innovative enterprises, aiming to provide a comprehensive enterprise-level cloud ERP total solution. A SQL injection vulnerability exists in UFIDA U8 Cloud, which can be exploite...