CVE-2026-102511 Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X PLC4Go allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's...

CVE-2026-102511

Apache PLC4X is vulnerable to an improper verification of source during ADS discovery. In the PLC4Go implementation, an attacker can send spoofed UDP datagrams to force the host to derive connection addresses from the response body's AmsNetId instead of the actual source address. This allows an a...

CVE-2026-97984

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local user could cause a Denial of Service DoS by exploiting an integer overflow in the User Datagram Protocol UDP length calculation. When Path MTU Discovery is enabled on a network device configured with an unusually large...

CVE-2026-102511: Improper Verification of Source of a Communication Channel

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X PLC4Go allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's...

PT-2026-103084

Name of the Vulnerable Software and Affected Versions Apache PLC4X PLC4Go versions 0.11.0 through 0.9.9 Apache PLC4X PLC4J ADS and Modbus drivers versions 0.10.0 through 0.9.9 Apache PLC4X PLC4J EtherNet/IP driver versions 0.11.0 through 0.9.9 Description Improper verification of the communicatio...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-100289

Devolutions Server version 2026.3.5.0 and earlier versions are affected by a missing authorization vulnerability in the gateway network scan token API . An authenticated low-privileged user can exploit this by sending a crafted API request to generate a network scan token. This allows the attacke...

EUVD-2026-89026

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2021-29441

CVE-2021-29441 - Nacos 인증 우회 CVE-2021-29441 는 Nacos 버전 1.4.1 미만에 영향을 미치는 치명적인 인증 우회 취약점입니다. Nacos는 클라우드 네이티브 환경에서 사용되는 동적 서비스 검색, 구성 관리 및 서비스 관리를 위한 인기 있는 플랫폼입니다. 이 취약점으로 인해 인증되지 않은 공격자가 인증 제어를 우회하고 취약한 Nacos 서버에서 관리 작업을 수행할 수 있습니다. 취약점 상세 정보 필드| 값 ---|--- CVE| CVE-2021-29441 심각도| 심각 CVSS v3.1| 9...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module tar (CVE-2026-59871, CVE-2026-59873, CVE-2026-59874 and CVE-2026-59875)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to Node.js module tar. Vulnerability Details CVEID:CVE-2026-59871 DESCRIPTION: node-tar ...

CLEANSTART-2026-HE89623 Security fix for ghsa-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.18.0-r3, kube-state-metrics-fips 2.19.1-r1, istio-pilot-discovery 1.31.1-r0

ghsa-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-100289: Missing Authorization

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

PT-2026-102669

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

opensource_defect_repare_cc

需求 漏洞挖掘与修复 项目中在code目录下的代码仓有已知的若干漏洞，你需要重写该项目的核心模块（接口完全不变，实现方式变化，重构前后相似度不超过20%，所有public/private方法签名，异常声明，注解，泛型，类继承关系必须和原项目一致，并且重构前后功能保持一致，通过测试所有已知的接口行为和输入输出一致性，验证前后功能的一致性），并修复代码仓中的全部已知bug，修复前后性能劣化不超过5%，中work/docs放置README.md，内容为AI重构流程说明（如何分解模块，验证正确性，修复bug，降低重复率），用于评委主观评审。...

CVE-2026-59739

A flaw was found in Apache ZooKeeper. This vulnerability allows a remote attacker to discover paths that should be restricted by Access Control Lists ACLs. By registering watches on non-existent paths and then reconnecting after these paths are created with restricted ACLs, the attacker can bypas...

Cheap to Hypothesize, Costly to Verify: The Defense Surface of Agentic Vulnerability Discovery

Autonomous LLM agents turn vulnerability discovery into a repository-scale search: they generate many vulnerability hypotheses but can verify only a subset under a finite budget. We show that autonomous vulnerability discovery exhibits a hypothesis-verification asymmetry, where verifying a...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core

Summary IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations...

ethibench

From Controlled to the Wild: Evaluation of Pentesting Agents in the Real-World AI pentesting agents are increasingly credible as offensive security systems, but current benchmarks still provide limited guidance on which systems will perform best on real-world targets. Most existing evaluations...