CVE-2026-107608

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

PT-2026-108194

Name of the Vulnerable Software and Affected Versions aws-cdk-lib versions prior to 2.267.0 Description Improper link resolution before file access in the asset bundling output handling allows a context-dependent actor to cause files from the build host to be published as the deployed asset...

CVE-2026-8340

Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with editfilecontents permission is CSRF'd into publishing an attacker-chosen previously-uploaded version downgrade to an older version of a file, or activation of a co-editor's unpublished version. The...

CVE-2023-46655

CVE-2023-46655 affects Jenkins CloudBees CD Plugin 1.1.32 and earlier, which, during the CloudBees CD - Publish Artifact post-build step, follows symbolic links to locations outside the published artifacts directory. This can allow attackers who can configure jobs to publish arbitrary files from ...

CVE-2022-29244

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. "--workspaces", "--workspace=". Anyone who has run "npm pack" or "npm publish" inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have...

dotCMS security vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports modules such as RSS feeds, blogs, and forums, and is easy to extend and build. A security vulnerability exists in dotCMS that stems from the fact that dotCMS does not clean up temporary file names. An...

Thousands of websites defaced after Belgium and Netherland domain registrars hacked

On Tuesday, The Foundation for Internet Domain Registration .NL in the Netherlands SIDN was compromised and some malicious files were uploaded to their server by hackers. According to a blog post, SQL injection vulnerability was used to compromise one of the website 25jaarvan.nl on same server...