CS-Cart Multi-Vendor Authentication Bypass

The vulnerability of the CS-Cart Multi-Vendor software for electronic shopping platforms relates to the bypassing of authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely compromise the integrity and accessibility of protected information...

CS-Cart Multi-Vendor Authentication Bypass

The vulnerability of the CS-Cart Multi-Vendor software for electronic shopping platforms relates to the bypassing of authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely compromise the integrity and accessibility of protected information...

CS-Cart Multi-Vendor Code Execution

The vulnerability of the software for electronic shopping platforms CS-Cart Multi-Vendor relates to the unlimited download of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CS-Cart Multi-Vendor Code Execution

The vulnerability of the CS-Cart Multi-Vendor software for electronic shopping platforms is related to insufficient control over resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CS-Cart Multi-Vendor Authentication Bypass

The vulnerability of the CS-Cart Multi-Vendor software for electronic shopping platforms relates to the bypassing of authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely compromise the integrity and accessibility of protected information...

Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2026-24513, CVE-2026-1580, CVE-2026-24514, CVE-2026-24512)

Summary IBM Cloud Kubernetes Service is affected by multiple Kubernetes Ingress Controller security vulnerabilities. - A user with access to create or update Ingress objects can use the rules.http.paths.path Ingress field to inject configuration into nginx CVE-2026-24512 - The...

Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP

The rapid development of the AI agent communication protocols, including the Model Context Protocol MCP, Agent2Agent A2A, Agora, and Agent Network Protocol ANP, is reshaping how AI agents communicate with tools, services, and each other. While these protocols support scalable multi-agent...

php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images

A flaw was found in PHP. The getimagesize function may leak uninitialized heap memory when processing images in multi-chunk mode, such as through php://filter. This vulnerability, caused by a bug in phpreadstreamallchunks that overwrites the buffer without advancing the pointer, allows an attacke...

Multi-Vendor BIOS Security Vulnerabilities (February 2026) - Lenovo Support US

No description provided...

Exploit for Improper Access Control in Oracle Http_Server

CVE-2026-21962 Concurrent WebLogic Scanner/Exploiter High-per...

StealthRL: Reinforcement Learning Paraphrase Attacks for Multi-Detector Evasion of AI-Text Detectors

AI-text detectors face a critical robustness challenge: adversarial paraphrasing attacks that preserve semantics while evading detection. We introduce StealthRL, a reinforcement learning framework that stress-tests detector robustness under realistic adversarial conditions. StealthRL trains a...

GHSA-FM6W-RRP3-2X4W Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService UMA Protection API. When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first...

CVE-2026-25811

CVE-2026-25811 affects PlaciPy 1.0.0. Root cause: tenant identifiers are derived from user email domains without validating domain ownership/registration, enabling cross-tenant data access. Impact is cross-tenant data exposure; CVSS notes indicate high confidentiality/integrity impact in some vec...

CVE-2026-25811 PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access...

Craft CMS: GraphQL Asset Mutation Privilege Escalation

There is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not...

CVE-2025-14778

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService UMA Protection API. When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first...

SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers

Microsoft has revealed that it observed a multi‑stage intrusion that involved the threat actors exploiting internet‑exposed SolarWinds Web Help Desk WHD instances to obtain initial access and move laterally across the organization's network to other high-value assets. That said, the Microsoft...

Exploit for CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloa...

CVE-2026-2138

A vulnerability was found in Tenda TX9 up to 22.03.02.10multi. Affected is the function sub42D03C of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used...

PT-2026-7127

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A Broken Access Control issue exists within the UserManagedPermissionService UMA Protection API. Specifically, when updating or deleting a UMA policy linked to multiple resources, the system...