sbomlyze v0.3.4

sbomlyze git diff for your SBOM. Compare two Software Bills of Materials and see what changed between builds, versions, and releases. sbomlyze compares component hashes, not only version strings. When an attacker swaps a package without bumping its version, sbomlyze flags it. Generators and...

Exploit for Use of Uninitialized Variable in Citrix Netscaler_Application_Delivery_Controller

CVE-2025-5777 — CitrixBleed 2 Citrix NetScaler Memory Disclos...

PT-2026-64080

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge kv map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The...

PT-2026-63995

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...

PT-2026-63990

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.3.3 Description When using the IN PLACE mode, the software fails to sanitize DOM elements that originate from a different window or realm, such as an iframe's contentDocument. This occurs because a cross-real...

PT-2026-63972

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

Logto Identity Platform has authentication and authorization failures in core protocol handling

Overview The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, ...

PT-2026-63903

Contributor Cross Site Scripting XSS in LA-Studio Element Kit for Elementor = 1.6.2 versions...

PT-2026-64019

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to validate the SAML element. This allows attackers to remove time and audience restrictions, which enables the indefinite replay of assertions. SAML Security Assertion Markup...

PT-2026-64111

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...

PT-2026-63910

Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...

Vim < 9.2.0725 Out-of-bounds Write (GHSA-m3hf-xcm3-xhm2)

The version of Vim installed on the remote host is prior to 9.2.0725. It is, therefore, affected by a vulnerability as referenced in the GHSA-m3hf-xcm3-xhm2 advisory. - Vim's single-byte branch of spellsoundfoldsal in src/spell.c translates a word through a spell file's SAL sound-folding rules in...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3166-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issu...

PT-2026-63909

Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...

PT-2026-63991

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.0 Description Function predicates provided via ADD ATTR or ADD TAGS to the DOMPurify.sanitize function persist in the internal state EXTRA ELEMENT HANDLING across multiple calls on the same instance. If a...

TencentOS Server 2: freerdp (TSSA-2026:0751)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0751 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:3167-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3167-1 advisory. This update for tomcat fixes the following issues Update to Tomcat 9.0.119. Security issues fixed: - CVE-2026-50229: improper neutralization of...

TencentOS Server 2: gstreamer-plugins-base and gstreamer-plugins-good (TSSA-2026:0755)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0755 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Security update for the Linux Kernel (important)

openSUSE security update: security update for the linux kernel ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21388-1 Rating: important References: bsc1149651 bsc1204315 bsc1236743 bsc1255029 bsc1257506 bsc1258538 bsc1259800 bsc1260565 bsc1261250...

Exposure of Data Element to Wrong Session

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the connection-scoped trailers handling in the HTTP/1.1 request processing path. ...