EUVD-2026-84051

Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-82165

Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

airflow-clickhouse-plugin (1.2.0), airflow-tools (>=0.8.5, <=0.9.1) +2 more potentially affected by CVE-2026-75158 via apache-airflow (2.8.4)

apache-airflow PYPI version 2.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.2.0 - airflow-tools =0.8.5, =0.0.4, =2.4.0rc1, =2.5.1 Source cves: CVE-2026-75158 Source advisory:...

PT-2026-96221

Name of the Vulnerable Software and Affected Versions Dell Command | Integration Suite for System Center versions prior to 6.7.2 Description Incorrect default permissions allow a low privileged attacker with local access to potentially cause information disclosure. Recommendations Update to versi...

CVE-2026-82165: Incorrect Default Permissions

Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

Malicious code in @pwaplatform/module-sso-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...

MAL-2026-16299 Malicious code in @pwaplatform/module-sso-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...

CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-18346: Missing Authorization

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-15660: Missing Authorization

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

WordPress TikTok plugin <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover vulnerability

Missing Authorization to Unauthenticated TikTok Integration Takeover vulnerability discovered by Hillary Mutai in WordPress Plugin TikTok versions = 1.4.1...

org.keycloak:keycloak-crypto-elytron (>=26.6.0, <=26.7.5), org.keycloak:keycloak-saml-wildfly-elytron-adapter (>=26.6.0, <=26.7.5) +2 more potentially affected by CVE-2026-10832 via org.wildfly.security:wildfly-elytron (>=2.7.0.cr1, <=2.8.5.final)

org.wildfly.security:wildfly-elytron MAVEN version =2.7.0.cr1, =26.6.0, =26.6.0, =26.6.0, =26.7.5 - org.wildfly:wildfly-webservices-tests-integration 38.0.0.beta1 Source cves: CVE-2026-10832 Source advisory: MEND:CVE-2026-10832...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to IBM Java SDK

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to IBM Java SDK. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is...

Oracle WebLogic Server (September 2026 CSPU)

The version of Oracle WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: TopLink Integration. Supported versions that...

at.chrl:chrl-orm-spring-integration (1.1.0), com.centurylink.mdw:mdw (>=6.0.05, <=6.0.06) +4 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (1.2.2)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - at.chrl:chrl-orm-spring-integration 1.1.0 - com.centurylink.mdw:mdw =6.0.05, =6.0.03,...

WordPress Dataverse Integration plugin < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure vulnerability

Contributor+ Server-Side Template Injection SSTI to Information Disclosure vulnerability discovered by dangnosuy in WordPress Plugin Dataverse Integration versions 2.91...

com.abiquo:commons-amqp (>=2.0.0, <=3.0.0), com.bluelock:camel-spring-amqp (>=1.0, <=1.2) +2 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (2.5.0)

com.rabbitmq:amqp-client MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.abiquo:commons-amqp =2.0.0, =1.0, =2.1.0.release, =2.1.6.release Source cves: CVE-2026-75516 Source advisor...

org.graylog2:graylog2-inputs (>=0.21.0-beta2, <=0.92.0-beta.1), org.graylog2:graylog2-shared (>=0.21.0-beta2, <=0.92.0-beta.1) +2 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (3.2.4)

com.rabbitmq:amqp-client MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.graylog2:graylog2-inputs =0.21.0-beta2, =0.21.0-beta2, =1.3.0.release, =1.3.2.release -...

Malicious Package

Overview leadconduit-integration-autoresponder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...