CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

EUVD-2026-51177

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses yaml-1.10.2.tgz, idna-3.10-py3-none-any.whl, pyjwt-2.12.1-py3-none-any.whl, postcss-8.5.3.tgz, postcss-selector-parser-6.0.10.tgz which are vulnerable to CVE-2026-33532, CVE-2026-45409, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525,...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses pillow-12.2.0-cp314-cp314-manylinux227x8664.manylinux228x8664.whl, immutable-4.3.8.tgz, urllib3-2.6.3-py3-none-any.whl, form-data-4.0.5.tgz, pyjwt-2.12.1-py3-none-any.whl which are vulnerable to CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380,...

CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

CVE-2026-15658

CVE-2026-15658 affects the foreUP customer REST API. The issue is a missing object-level authorization (BOLA/IDOR) that allows any authenticated, low-privilege foreUP customer to request an endpoint that returns another customer’s data without verifying ownership. Documented impact includes acces...

EUVD-2026-51159

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...

CVE-2026-67348

Julep contains an insecure direct object reference vulnerability in the getexecutiondetails endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary executionid values to retrieve sensitive execution records including task inputs, outputs,...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-12947

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...

CVE-2026-58222 Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

EUVD-2026-51155

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-67348

Julep exposes an insecure direct object reference in GET /executions/{execution_id} (get_execution_details). The vulnerability lets authenticated tenants read another tenant’s execution data by supplying arbitrary execution_id values, exposing task inputs, outputs, metadata, and temporal task tok...

CVE-2026-67348 Julep Insecure Direct Object Reference via GET /executions/{execution_id}

Julep contains an insecure direct object reference vulnerability in the getexecutiondetails endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary executionid values to retrieve sensitive execution records including task inputs, outputs,...

CVE-2026-67348 Julep Insecure Direct Object Reference via GET /executions/{execution_id}

Julep contains an insecure direct object reference vulnerability in the getexecutiondetails endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary executionid values to retrieve sensitive execution records including task inputs, outputs,...

EUVD-2026-51151

Julep contains an insecure direct object reference vulnerability in the getexecutiondetails endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary executionid values to retrieve sensitive execution records including task inputs, outputs,...

EUVD-2026-51150

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

EUVD-2026-51146

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...

CVE-2026-12947

CVE-2026-12947 affects IBM App Connect Enterprise versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27. The issue involves storing potentially sensitive information in log files that could be read by a local user (CWE-532). IBM’s advisory lists the remediation via APAR IT49670, with fixes available...

CVE-2026-12947 IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...