EUVD-2026-74954

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

afrog v3.5.7

A Security Tool for Bug Bounty, Pentest and Red Teaming English • 中文 What is afrog afrog is a high-performance security scanning toolkit built for bug bounty, pentest, and red team workflows. It combines fast target probing, built-in vulnerability checks, custom PoC authoring, and SDK-driven...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.3.25 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.2.31 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

Wicked Problem, Parsimonious Solution: Securing Electric Vehicle Charging Station Software

Electric vehicle charging infrastructure presents a suite of novel cyber-physical threats. Among this infrastructure, charging stations are the most vulnerable elements. The software in the charging station supply equipment is particularly vulnerable. Currently, the software is an attack surface...

Learning Intrusion Response Strategies for OT Systems

Cyberattacks against Operational Technology OT systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an...

Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation

The integration of Large Language Models LLMs into Security Operations Centers SOCs streamlines threat intelligence but introduces critical vulnerabilities, notably indirect prompt injection via log poisoning. Adversaries exploit this vector to execute multistep "promptware'' kill chains by...

Linux Distros Unpatched Vulnerability : CVE-2026-82074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a special...

Linux Distros Unpatched Vulnerability : CVE-2026-82073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks...

List of Security Fixes and Improvements in Veeam Backup for Salesforce

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Backup for Salesforce. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases. Security...

CVE-2026-53638 Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/tokenValue/payments/paymentId endpoint, used by an...

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

EUVD-2026-74284

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

CVE-2026-55250 Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

CVE-2026-55250

Maravel Framework (a PHP dependency-injection framework), prior to version 10.74.0 , is affected by a Token Replay Vulnerability (CVSS 8.7 HIGH). The root cause is a lifecycle mismatch: tymon/jwt-auth writes 14-day JWT blacklist entries into tagged cache, but Maravel's O(1) Atomic Lazy Eviction m...

CVE-2026-55250 Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

EUVD-2026-74283

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-53933

Maravel , a PHP dependency-injection framework, is vulnerable to side-channel information disclosure via dynamic route fuzzing in versions prior to 10.73.1 . When routes are compiled with dynamic placeholders (e.g., /api/v1/users/{id}), the raw placeholder key is mistakenly registered into the fl...

CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...