CVE-2026-82549 Linux Foundation Magma SecurityModeComplete integrity check

A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched remotely. The exploit is publicly available and might...

EUVD-2025-210809

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

PT-2026-83442

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

CVE-2025-64649

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

CVE-2025-36290 IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36290

IBM Integrated Analytics System (IIAS) versions 1.0.0.0 through 1.0.31.0 contain a vulnerability in the JWT service component (apjwtservice.py module), where SSL/TLS server certificate validation is not enabled on an SSL/TLS connection. This allows a remote attacker to perform man-in-the-middle a...

EUVD-2026-67820

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-13761

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping...

CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping...

CVE-2026-13761

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs used for loop conditions , which can cause excessive looping and potentially lead to denial of service or other consequences. The vulnerability is exploitable over the network with low complexity and no p...

CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping...

EUVD-2026-67718

Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping...

CVE-2026-80592

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on top of struct damonregion clearly says that For any use case, @ar should be non-zero positive size. which is now verified in...

CVE-2026-80591

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fslistxattr. Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a...

EUVD-2026-67309

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

PT-2026-83320

Name of the Vulnerable Software and Affected Versions IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 Description The system fails to properly validate TLS certificates. This flaw allows an attacker to perform man-in-the-middle techniques to intercept and obtain sensitive...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cpio (UTSA-2026-092976)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-092976 advisory. In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an...

CVE-2026-61466

A flaw was found in Apache CXF. The OAuth2 Dynamic Client Registration endpoint in Apache CXF does not properly validate the scope value provided during client registration. This oversight allows a malicious client to assign itself privileged access scopes, potentially leading to unauthorized...

CVE-2026-74752

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP. When cookie authentication is disabled, the system improperly validates authentication AUTH fields restored directly from peer-controlled cookie bytes. A local attacker could exploit this by forging RANDOM lengths o...

CVE-2026-59317: Improper Validation of Specified Quantity in Input

DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...