CVE-2026-29036

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

Microsoft Patch Tuesday, August 2026 Security Update Review

The August 2026 Microsoft Patch Tuesday release delivers security fixes for vulnerabilities affecting a wide range of Microsoft products and services. As attackers continue to exploit unpatched vulnerabilities, timely patching remains critical for reducing exposure and strengthening enterprise...

CVE-2026-29036 cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-29036

Affected software: cJSON library (versions 1.5.0–1.7.19). Component: decode_pointer_inplace() in cJSON_Utils.c. Issue: Incorrectly-resolved name/reference vulnerability that lets unauthenticated attackers manipulate JSON Patch paths by supplying crafted JSON Pointer escape sequences (~0, ~1). Imp...

EUVD-2026-57008

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-29036

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-48763

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

Patch Tuesday - August 2026

Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday, including 236 vulnerabilities in Windows. This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to suppose that Patch Tuesday will ever...

CVE-2026-48763

TypeBot prior to v3.17.0 exposes a deprecated public upload endpoint GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url that returns a presigned S3 PUT URL for an attacker-controlled filePath. An unauthenticated attacker who knows a valid public typebotId and blockId can obtain ...

CVE-2026-48763 TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

EUVD-2026-56979

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

CVE-2026-48763

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

CVE-2026-6368

A flaw was found in glibc GNU C Library. A local attacker or application using the wordexp function with the WRDEAPPEND flag can trigger the interface to return invalid memory in the wewordv member. This invalid memory, when subsequently processed by wordfree, may cause the process to abort,...

threat-intel-toolkit

Threat Intel Toolkit A reusable, shareable bundle for defen...

Vulnerabilities in Microsoft Windows

Microsoft has fixed a large number of vulnerabilities in Windows. An attacker could exploit these vulnerabilities to carry out attacks that could result in the following types of damage, as listed in the table below. The most severe vulnerabilities are identified by the following CVE numbers:...

CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-68147

A flaw was found in the Linux kernel's fscrypt component. When a cryptographic key blkcryptokey is being evicted, the system attempts to dynamically allocate memory. If this allocation fails, the key may be freed prematurely without proper eviction, leading to a use-after-free vulnerability. This...

Security Bulletin: IBM Watsonx BI Assistant for CP4D affected by multiple CVEs

Summary Multiple CVE's were addressed in IBM Watsonx BI Assistant for CP4D version 5.4 patch 4 Vulnerability Details CVEID:CVE-2026-44665 DESCRIPTION: fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it...

Malicious code in base65-15x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00fcb69b2f5c7e64ede8df36e3865dad82632ef076c6c2974b568727ec046062 base65-15x is a typosquat of the base-x package. Its decode function does not perform base decoding; instead it POSTs the caller-supplied string...

MAL-2026-13748 Malicious code in base65-15x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00fcb69b2f5c7e64ede8df36e3865dad82632ef076c6c2974b568727ec046062 base65-15x is a typosquat of the base-x package. Its decode function does not perform base decoding; instead it POSTs the caller-supplied string...