Security Bulletin:lxml Local File Access Vulnerability: Fixed in 6.1.0

Summary lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration with resolveentities=True allows untrusted XML input to read local files. Setting the resolveentities option explicitly to...

K000162757: Spring Security vulnerability CVE-2026-47838

Security Advisory Description SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected...

Security Bulletin:DNS Name Constraints Validation Issue Fixed in cryptography v46.0.6

Summary cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently,...

Security Bulletin:Pallets Click 8.3.2 Command Injection Vulnerability

Summary Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands from an unprivileged account. Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions 8.3.2 and below,...

K000162755: Node.js CVE-2026-48937

Security Advisory Description A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24. CVE-2026-48937 Impact There is no impact; F5 products are not affected b...

Exploit for CVE-2026-52680

CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbit...

Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.

Summary There are vulnerabilities in the jackson-databind jar used by IBM APM Linux KVM Agent for Virtual Environments. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...

K000162754: Linux kernel AMD KFD driver vulnerability CVE-2026-53143

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpointmqd/restoremqd for KFDMQDTYPESDMA queues. These...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Exploit for Out-of-bounds Write in Samsung Android

--- CVE-2026-21018 – OPC UA Authentication Bypass via None S...

Exploit for CVE-2026-21014

--- CVE-2026-21014 – CAN Bus Frame Replay Attack on Automoti...

Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI (CVE-2026-59879, CVE-2026-59880)

Summary IBM Tivoli Netcool/OMNIbus WebGUI includes the Immutable.js library for persistent immutable data structures used in the client-side UI. Vulnerabilities have been identified in this library that could affect the product. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js...

Exploit for CVE-2026-21006

--- CVE-2026-21006 – Zigbee Light Link Factory Reset Exploit...

bxploit

BXPLOIT AI-Powered Penetration Testing Framework built on Kim...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory. In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-2040)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2040 advisory. BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.This issue affects BIND 9 versions 9.18.0 through 9.18.50,...

Important: dotnet10.0

Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: gpio: Fix resource leaks on errors in gpiochipadddatawithkey CVE-2026-31732 In the Linux kernel, the...