Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway for Multiplatforms including gdb, gdb-headless, pip, gzip, unbound-libs, tar, binutils, libpkgconf, pkgconf, pkgconf-m4, pkgconf-pkg-config, python3-unbound, platform-python-pip,...

CVE-2026-92914

AVideo LoginControl is a WordPress plugin for video management. The vulnerability resides in its PGP second-factor authentication mechanism, where challenge responses are compared using loose equality (==) against an uninitialized session variable. An attacker who possesses a victim's password ca...

EUVD-2026-81436

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

CVE-2026-92914

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

SUSE-SU-2026:23873-1 Security update for jq

This update for jq fixes the following issues: Security issues fixed: - CVE-2015-8863: heap buffer overflow in tokenadd function bsc976992. - CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString bsc1218034. - CVE-2023-50268: stack-based buffer overflow ...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

certgraveyard_yara v2026.09.16

CertGraveyard YARA Rules Generator Automated YARA rule generation from the CertGraveyard compromised certificate database. Features 🔄 Daily Updates : Automatically checks CertGraveyard for new compromised certificates 📝 YARA Rule Generation : Creates individual YARA rules for each certificate ✅...

crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...

golang-fips: Golang FIPS zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

attack-surface

ASP — Public Network Attack Surface Automation Mapping and Vul...

Exploit for CVE-2026-44840

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassw...

EUVD-2026-81291

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

PT-2026-95105

Name of the Vulnerable Software and Affected Versions Caddy Proxy Manager versions prior to 1.5.1 Description Caddy Proxy Manager allows unauthenticated remote actors to create active accounts with the user role without administrator approval. This occurs because email and password...

PT-2026-94389

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.18 Description The Restore and Maintenance tools pass the client-supplied database field directly as the value of the --dbname option for pg restore and psql. Because libpq expands database names containing an...

CVE-2026-15815: Improper Link Resolution Before File Access

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...