136595 matches found
CVE-2026-51252
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51260
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51261
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Security Bulletin: IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)
Summary IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details CVEID:CVE-2026-14974 DESCRIPTION: IBM WebSphere Application Server traditional could allow a remote attacker to execute arbitrary...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Cryptographic Algorithm vulnerability in Bouncy Castle [CVE-2026-5588]
Summary IBM Watson Speech Services Cartridge is vulnerable to a Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc, due to a flaw in BC-JAVA bcpkix on all pkix modules CVE-2026-5588. Bouncy Castle is used in our speech microservices. This vulnerabili...
Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its...
Security Bulletin: IBM Rhapsody Systems Engineering is vulnerable to prototype pollution abuse
Summary A security vulnerability was identified in the axios package used in IBM Rhapsody Systems Engineering. The issue has been resolved and patched. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and...
K000162478: PostgreSQL vulnerability CVE-2026-6637
Security Advisory Description Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint"...
Security Bulletin: IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)
Summary IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details CVEID:CVE-2026-14976 DESCRIPTION: IBM WebSphere Application Server Liberty is affected by remote code...
GHSA-4PJ9-G833-QX53 lettre has TLS hostname verification disabled when using Boring TLS backend
Summary An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN...
lettre has TLS hostname verification disabled when using Boring TLS backend
Summary An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN...
dependo
dependo A proof of concept for state-of-the-art observability...
Security Bulletin: IBM WebSphere Application Server is affected by a privilege escalation (CVE-2026-14446)
Summary IBM WebSphere Application Server is affected by a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2026-14446 DESCRIPTION: IBM WebSphere Application Server is vulnerable to broken access control/privilege escalation in the administrative console. CWE:CWE-306: Missing...
exploit-counter
exploit-counter !cihttps://github.com/nickharris808/explo...
Security Bulletin: IBM WebSphere Application Server is affected by an authentication bypass (CVE-2026-16184)
Summary IBM WebSphere Application Server is affected by an authentication bypass. Vulnerability Details CVEID:CVE-2026-16184 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. CWE:CWE-862: Missing...
Malicious code in streak-daily-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...
MAL-2026-11150 Malicious code in streak-daily-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...
CVE-2026-4648
Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...
CVE-2026-4648 Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands
Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...
CVE-2026-4648 Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands
Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...