CVE-2026-92085

The Talassoft Industrial Management Software by TMT Machinery Industry and Trade Co. Ltd. contains a Stored XSS vulnerability (CWE-79) caused by improper neutralization of input during web page generation. This issue affects versions before V16.0.1 . Attackers could potentially execute malicious ...

csw-slides-2024

2024年に安全なソフトウェアを開発する 概要 人類がコンピュータシステムへの依存度を高めるにつれ、安全で信頼性の高いソフトウェアの必要性は極めて重要になっています。今日では、飛行機、電車、自動車から歯ブラシや調理台に至るまで、あらゆるものに無数の小型コンピュータが搭載されています。これらの各システムには、コンピュータに仕事の遂行方法を指示し、他のコンピュータと接続するために書かれたソフトウェアが含まれています。これらのシステムにおけるセキュリティ問題は、状況に依存しますが、軽微な不快感から人命の喪失に至るまでの結果を引き起こしてきました。...

CVE-2026-87752 HTML Injection in Rolantis Information Technologies' Agentis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CVE-2026-87752 HTML Injection in Rolantis Information Technologies' Agentis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CVE-2026-12718 SQLi in Karel Electronics' KarelIPS

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection. This issue affects KarelIPS: through 22092026. NOTE: The vendor was contacted and it was learned that the product is no...

Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening

AI labs are toying with an industry-wide pact to slow development. Meanwhile, widely available AI chatbots are already helping uncover a tidal wave of security flaws...

CVE-2026-16726

Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows...

CVE-2026-16726: Buffer Copy without Checking Size of Input

Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows...

CVE-2026-7298: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: before 8.4.2.0...

CVE-2026-18630: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

PT-2026-84288

Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-77142 Broken Access Control in extension "Industry Directory" (yellowpages2)

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

CVE-2026-77142 Broken Access Control in extension "Industry Directory" (yellowpages2)

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

CVE-2026-77142

CVE-2026-77142 is a Broken Access Control vulnerability in the TYPO3 extension Industry Directory (yellowpages2) . The frontend self-service editing feature hides the edit form using a template-level visibility flag for company records a visitor does not own, but the corresponding server-side wri...

TYPO3-EXT-SA-2026-020: Broken Access Control in extension "Industry Directory" (yellowpages2)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-020...

CVE-2026-16286: Unrestricted Upload of File with Dangerous Type

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...

Akamai Named a Leader in The Forrester Wave™: Microsegmentation Solutions, Q3 2026

...

Emerging Challenges in Threat Modeling for GenAI-Augmented Systems: A View from the Trenches

Threat modeling remains a central task in secure software engineering, as it enables the identification of security issues from system architectures. As Generative Artificial Intelligence GenAI becomes increasingly pervasive across software systems, traditional threat modeling methods e.g., STRID...

CVE-2026-8287: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation. This issue affects Online Pre-Accounting Software: through 17072026...

CVE-2026-2406: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...