Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Summary A non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync. The regular integration endpoint POST /api/integration correctly blocks this, but the Sync API bypasses the...

GHSA-GV8P-48FR-4FXG Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Summary A non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync. The regular integration endpoint POST /api/integration correctly blocks this, but the Sync API bypasses the...

CVE-2026-41235 Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Froxlor is open source server administration software. Version 2.3.6 lets administrators configure system.availableshells as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit...

CVE-2026-41235

Froxlor is open source server administration software. Version 2.3.6 lets administrators configure system.availableshells as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit...

CVE-2026-41235 Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Froxlor is open source server administration software. Version 2.3.6 lets administrators configure system.availableshells as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit...

Security Bulletin: Vulnerability in jackson-core-2.15.2.jar

Summary Vulnerability in jackson-core-2.15.2.jar Vulnerability Details ID:WS-2026-0003 DESCRIPTION: The non-blocking async JSON parser in jackson-core bypasses the maxNumberLength constraint default: 1000 characters defined in StreamReadConstraints. This allows an attacker to send JSON with...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationRuntime and IntegrationServer operands that use Kafka are vulnerable to loss of confidentiality (CVE-2025-27817, CVE-2025-27818)

Summary Apache Kafka Client is used by IBM App Connect Enterprise Certified Container when running flows that connect to a Kafka server. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Kafka Client are vulnerable to loss of confidentiality...

WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Frissi0n in WordPress Plugin Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms versions = 1.4.3...

WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Frissi0n in WordPress Plugin Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms versions = 1.1.8...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-42253 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-42253 Source advisory: MEND:CVE-2026-42253...

PT-2026-46864

Summary A non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/ action/sync. The regular integration endpoint POST /api/integration correctly blocks this, but the Sync API bypasses th...

PT-2026-46884

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1 Description A non-admin API user with integration:create ACL privilege can escalate their privileges to full administrator. This is possible by creating an integration wi...

An Improved CNN-LSTM Based Intrusion Detection System for IoT Networks

With the rapid proliferation of IoT devices, security concerns have dramatically escalated and intrusion detection systems have become critical for protecting networked environments. This paper presents an improved CNN-LSTM based intrusion detection model that combines multi-class classification,...

PT-2026-49132

This update for rpcbind fixes the following issues Update to rpcbind 1.2.9: Security issue: - Fix several memory leaks and buffer overflows bsc1267212. Non security issue: - rpcbind fails to start tumbleweed snapshot 20181120 bsc1117217. Changes: rpcinfo: stack buffer overflow in rpcinfo...

PDF.js XSS

The vulnerability of the application for integrating PDF.js files with cloud-based software for creating and using data storage in NextCloud Server is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scriptin...

CVE-2026-7312

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to...

CVE-2026-46257 clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sp804: Fix an Oops when readcurrenttimer is called on ARM32 platforms where the SP804 is not registered as the schedclock. On SP804, the delay timer shares the same clkevt instance with schedclock. On so...

arches (>=6.2.5, <=7.4.2), botbuilder-applicationinsights (>=0.0.1, <=4.14.8) +3 more potentially affected by CVE-2026-8404 via django (3.2.21)

django PYPI version 3.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - arches =6.2.5, =0.0.1, =0.0.1, =2024.5.0, =2024.6.0 - nemo 4.6.4 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

alcali (>=2018.3.2, <=2019.2.2), botbuilder-applicationinsights (>=4.7.0, <=4.14.2) +4 more potentially affected by CVE-2026-8404 via django (2.2.6)

django PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.2, =4.7.0, =4.10.0, =4.14.2 - kiwitcms 7.1.0 - ls-orb 0.1.0 - wazimap 2.1.0 Source cves: CVE-2026-8404 Source advisory:...

org.apache.mina:mina-example (1.1.3), org.apache.mina:mina-filter-codec-netty (1.1.3) +5 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.1.3)

org.apache.mina:mina-core MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.1.3 - org.apache.mina:mina-filter-codec-netty 1.1.3 -...