Security Bulletin: Vulnerability in AngularJS affects IBM License Key Server Administration and Reporting Tool

Summary Potential vulnerability in AngularJS has been identified that affects IBM License Key Server Administration and Reporting Tool. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-0716 DESCRIPTION: Improper sanitization ...

CVE-2025-59528

CVE-2025-59528 Proof of Concept English version PoC minimaliste et orienté validation technique de la vulnérabilité sur un environnement autorisé. Prerequis Avoir un compte utilisateur sur le dashboard Flowise cible. Disposer d'une clef API valide associee a ce compte. Demarrer un listener sur ta...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings...

Allocation of Resources Without Limits or Throttling

Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings against its limit. A...

EUVD-2026-69723

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.ph...

PT-2026-84655

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists where libcurl fails to enforce public key pinning when CURLOPT PINNEDPUBLICKEY is used in conjunction with options that disable standard peer verification, specifically CURLOPT S...

PT-2026-84746

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

CVE-2026-8151: Cross-Site Request Forgery (CSRF)

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

CVE-2026-75136: Insufficiently Protected Credentials

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...

PT-2026-84858

Name of the Vulnerable Software and Affected Versions UpSignOn for Windows versions prior to 7.19.0 Description Insecure credential storage allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering an authentication prompt. A standard...

Mesh module Code Execution

The vulnerability of the Mesh module in Microprogramming Software for TP-Link Deco XE75, XE5300, and WE10800 lies in the use of a rigidly encrypted cryptographic key. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and execute arbitrary code...

PT-2026-84662

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to,...

PT-2026-84778

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.580 Jenkins LTS versions prior to 2.568.3 Description The REST API fails to escape map keys when serializing objects as JSON and Python. This allows attackers who can control map property names to inject arbitrary...

Variational Probabilistic Quantization for Secret Key Generation

Secret key generation from correlated observations at Alice and Bob, in the presence of an eavesdropper Eve, underpins physical-layer security. Classical pipelines quantize by hand, amplify privacy afterwards, and optimize no objective tied to a key rate. We propose Variational Probabilistic...

PT-2026-84754

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Self-managed instances using Auth Proxy authentication with identity caching enabled where sync ttl is greater than zero are susceptible to an authentication bypass. The issue occurs because...

Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105540)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105540 advisory. A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty valu...

Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

Linux Distros Unpatched Vulnerability : CVE-2026-84375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not...

SecDT: A Profile-Based Security Layer for TRDP Communications

The Train Real-time Data Protocol TRDP is widely used on rolling stock but it provides limited native support for cryptographic protection. Furthermore, the multicast traffic profile used in TRDP Process Data to exchange critical information between onboard subsystems makes the introduction of...

CVE-2026-84481

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.ph...