GHSA-332X-R494-54FQ Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export

Summary The WordExport export flow only checks whether the current backend user has the feature permission wordexport. It does not verify access rights on the target element itself. As a result, a low-privileged backend user can export document content even when the user does not have view...

Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export

Summary The WordExport export flow only checks whether the current backend user has the feature permission wordexport. It does not verify access rights on the target element itself. As a result, a low-privileged backend user can export document content even when the user does not have view...

CVE-2026-45087

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

CVE-2026-45087 Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

EUVD-2026-32615

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

CVE-2026-45087

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

CVE-2026-45087

Dalfox (server mode) prior to v2.13.0 is vulnerable to unauthenticated remote code execution. When running dalfox server with default 0.0.0.0:6664 and no API key, POST /scan deserializes attacker-controlled options (FoundAction and FoundActionShell) into scan config, then shell commands are execu...

CVE-2026-45087 Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

CVE-2026-45087 Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

Latin America and Europe become the target of two banking trojan campaigns that are designed to infect Windows and Android devices with Grandoreiro and BTMOB malware, respectively. That's according to new findings from WatchGuard and ESET, which have observed the two malware families being used t...

Malicious npm Package Stole Files From Claude AI User Directory via GitHub

Cybersecurity researchers have discovered a new malicious package on the npm registry that comes with information stealing capabilities. According to OX Security, the package, named "mouse5212-super-formatter," is designed to upload files from "/mnt/user-data," a dedicated directory used by...

EUVD-2026-32271

IBM MQ Operator SC2: v3.2.0 through 3.2.23CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1LTS: v2.0.0 - 2.0.29 and IBM supplied MQ Advanced container images SC2: 9.4.0.6 through r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1,...

CVE-2026-2607

IBM MQ Operator SC2: v3.2.0 through 3.2.23CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1LTS: v2.0.0 - 2.0.29 and IBM supplied MQ Advanced container images SC2: 9.4.0.6 through r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1,...

CVE-2026-46597 vulnerabilities

Vulnerabilities for packages: syft, argocd-image-updater, docker-compose, witness, slsa-verifier, k9s, dagger, external-secrets-operator, pulumi-language-java, tkn, docker, glab, tw, flux-image-automation-controller, nuclei, crossplane-provider-family-aws, osv-scanner, argo-cd,...

CVE-2026-39828 vulnerabilities

Vulnerabilities for packages: cilium, istio, spire-server, telegraf, argocd-image-updater, trivy, cert-manager, kubernetes, kubernetes-dashboard, skaffold, nerdctl, zot, falco-no-driver, kine, chisel, flux-source-controller, trivy-operator, k3s, kaf, k9s, loki, containerd,...

CVE-2026-46595 vulnerabilities

Vulnerabilities for packages: cilium, istio, spire-server, telegraf, argocd-image-updater, trivy, cert-manager, kubernetes, kubernetes-dashboard, skaffold, nerdctl, zot, falco-no-driver, kine, chisel, flux-source-controller, trivy-operator, k3s, kaf, k9s, loki, containerd,...

CVE-2026-39829 vulnerabilities

Vulnerabilities for packages: syft, argocd-image-updater, witness, slsa-verifier, k9s, dagger, external-secrets-operator, pulumi-language-java, tkn, docker, glab, flux-image-automation-controller, nuclei, osv-scanner, argo-cd, crossplane-provider-azure-storage, rootlesskit, tflint, k8sgpt, melang...

CVE-2026-39831 vulnerabilities

Vulnerabilities for packages: syft, argocd-image-updater, witness, slsa-verifier, k9s, dagger, external-secrets-operator, pulumi-language-java, tkn, docker, glab, flux-image-automation-controller, nuclei, osv-scanner, argo-cd, crossplane-provider-azure-storage, rootlesskit, tflint, k8sgpt, melang...

CVE-2026-39832 vulnerabilities

Vulnerabilities for packages: syft, argocd-image-updater, k9s, dagger, external-secrets-operator, pulumi-language-java, flux-image-automation-controller, nuclei, osv-scanner, argo-cd, melange, flux, snyk-cli, nfpm, cilium, kubernetes, skaffold, act, terragrunt, nerdctl, zot, flux-source-controlle...

CVE-2026-39830 vulnerabilities

Vulnerabilities for packages: syft, argocd-image-updater, witness, k9s, dagger, external-secrets-operator, pulumi-language-java, docker, flux-image-automation-controller, nuclei, osv-scanner, argo-cd, rootlesskit, melange, flux, snyk-cli, nfpm, gh, cilium, gatus, kubernetes, skaffold, act,...