EUVD-2026-67345

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to information disclosure (CVE-2025-14483)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed information disclosure security vulnerability Vulnerability Details CVEID:CVE-2025-14483 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51,...

Security Bulletin: The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Information Disclosure (CVE-2025-36348)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the information disclosure vulnerability Vulnerability Details CVEID:CVE-2025-36348 DESCRIPTION: IBM Sterling B2B Integrator versions 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 through 6.2.1.1, an...

CVE-2026-78174

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover...

CVE-2026-61802

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

EUVD-2026-67279

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed fro...

EUVD-2026-67280

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

EUVD-2026-67281

Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access...

EUVD-2026-67312

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account...

CVE-2026-75418

A path traversal vulnerability exists in the built-in preview/development web server of Lektor 3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensiti...

CVE-2026-73809

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

CVE-2026-61783

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...

CVE-2026-18965

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account...

Microsoft Edge (Chromium) < 152.0.4191.53 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 152.0.4191.53. It is, therefore, affected by multiple vulnerabilities as referenced in the August 28, 2026 advisory. - Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-elytron (UTSA-2026-031644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031644 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

The vulnerability of the Sandboxing component in Firefox web browsers, Firefox ESR, and the Thunderbird email client allows a intruder to access confidential data.

The vulnerability of the Sandboxing component in Firefox web browsers, Firefox ESR, and the email client Thunderbird relates to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...

The vulnerability of the Dovecot mail server, related to deficiencies in pathname restriction, allows attackers to gain access to confidential data.

The vulnerability of the Dovecot mail server is related to deficiencies in pathname limitation. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: datanucleus-api-jdo (UTSA-2026-093015)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093015 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

UBUNTU-CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

PT-2026-83011

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWER SUPPLY PROP STATUS to a supplier power supply. If no supplier is registered, power supply get...