Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.

Summary brace-expansion is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-45149. Vulnerability Details CVEID:CVE-2026-45149 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6,...

curveball

curveball CVE-2020-0601 curveball - Calculateur de clés alternatif Compilation Windows Visual Studio 2012 ou supérieur, puis compilez la solution. Linux / Unix cc altkey.c -lcrypto -o altkey Utilisation Utilisation : altkey ecpubliccertificate.pem ecnewprivatekey.pem Exemple...

Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.

Summary picomatch is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-33671, CVE-2026-33672. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regul...

CVE-2026-21858

🚨 CVE-2026-21858 — « Ni8mare » Une vulnérabilité critique d'exécution de code à distance non authentifiée dans une plateforme open-source d'automatisation de workflows. 📖 Table des matières Aperçu Détails techniques Sévérité et CVSS Versions concernées Impact Exploitation Détection Correction...

TS_LLMLib

tsllmlib - Bibliothèque LLM de TrustedSec La bibliothèque LLM de TrustedSec est une bibliothèque Python permettant d'interagir avec des LLM locaux prenant en charge l'utilisation d'outils. Elle permet d'exécuter de grands workflows traditionnellement possibles uniquement avec des modèles de point...

Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.

Summary fast-xml-parser is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-73569. Vulnerability Details CVEID:CVE-2026-73569 DESCRIPTION: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until...

gixy

GIXY Vue d'ensemble Gixy est un outil pour analyser la configuration Nginx. Le principal objectif de Gixy est de prévenir les erreurs de configuration de sécurité et d'automatiser la détection des failles. Les versions de Python actuellement supportées sont 2.7, 3.5, 3.6 et 3.7. Avertissement :...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Improper Input Validation.

Summary uuid is used by IBM Fusion Data Foundation, which could cause Improper Input Validation. CVE-2026-41907. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but d...

CVE-2026-107722

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107724

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

Upload_Bypass

UploadBypass v3 حول Upload Bypass هي أداة بسيطة مصممة لمساعدة مختبرى الاختراق ومطاردي الثغرات في اختبار آليات رفع الملفات. تستخدم الأداة تقنيات متنوعة من برامج مكافآت الثغرات لتبسيط عملية تحديد واستغلال نقاط الضعف، مما يضمن تقييماً شاملاً لتطبيقات الويب. تم التطوير بواسطة Sagiv 🚀 التحديثات تمت...

GHSA-X937-HJ6V-793P fast-jwt: Verifier cache accepts expired JWTs without iat.

Summary cacheSet only derives its exp cache deadline inside hasIat src/verifier.js:127-140. JWT iat is optional. For a valid token with exp but no iat, cacheSet substitutes clockTimestamp + clockTolerance + cacheTTL src/verifier.js:142-146. Later, the cache path returns the saved payload before...

fast-jwt: Verifier cache accepts expired JWTs without iat.

Summary cacheSet only derives its exp cache deadline inside hasIat src/verifier.js:127-140. JWT iat is optional. For a valid token with exp but no iat, cacheSet substitutes clockTimestamp + clockTolerance + cacheTTL src/verifier.js:142-146. Later, the cache path returns the saved payload before...

GHSA-HMQ2-7HP6-7CRH Banks: User-controlled prompt input can be parsed as privileged chat messages

Summary Banks' Prompt.chatmessages method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as "role":"system","content":"...", Banks returns it as a privileged system message instead of treating it as plain...

Banks: User-controlled prompt input can be parsed as privileged chat messages

Summary Banks' Prompt.chatmessages method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as "role":"system","content":"...", Banks returns it as a privileged system message instead of treating it as plain...

GHSA-W294-6Q5Q-53P8 Hazelcast has an authorization bypass in IMap Predicates API

Impact Missing authorization checks in the Predicates API may allow a malicious client to execute arbitrary code on a Hazelcast member. Patches Enterprise customers should upgrade to a fixed version of Hazelcast Enterprise Edition: 5.7.0 5.6.1 5.5.10 5.4.5 Customers with extended support contract...

Hazelcast has an authorization bypass in IMap Predicates API

Impact Missing authorization checks in the Predicates API may allow a malicious client to execute arbitrary code on a Hazelcast member. Patches Enterprise customers should upgrade to a fixed version of Hazelcast Enterprise Edition: 5.7.0 5.6.1 5.5.10 5.4.5 Customers with extended support contract...

GHSA-C6RP-P8XM-4Q9F Mechanize sends credential headers to another origin after a meta refresh

Summary mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanizerequestheaders= followed a refresh that pointed at another origin. Details Mechanize::HTTP::Agentresponsefollowmetarefresh fetched the refresh target with no notion of a crossed origin, so...

Mechanize sends credential headers to another origin after a meta refresh

Summary mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanizerequestheaders= followed a refresh that pointed at another origin. Details Mechanize::HTTP::Agentresponsefollowmetarefresh fetched the refresh target with no notion of a crossed origin, so...

CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - Réinitialisation de mot de passe non authentifiée CVE-2025-15030 User Profile Builder — Réinitialisation de mot de passe non authentifiée → Prise de contrôle admin + Téléversement de shell / / \ |/ / / / / / \ / / / \ / \ | / | | //| \ / /| / |...