xworm-7.4-RCE-PoC

XWorm C2 Controller - 0-Day Remote Code Execution RCE !Au...

CVE-2026-102543

Impact For some client-issued requests concerning remote users or remote rooms belonging to a malicious homeserver, Synapse will make federation requests to that malicious homeserver and will forward received errors back to the client. This allows the malicious homeserver to cause the requesting...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

Expression Language Injection

Overview org.hibernate.validator:hibernate-validator is a Hibernate Validator Engine Relocation Artifact. Affected versions of this package are vulnerable to Expression Language Injection in the ParameterTermResolver class, whose resolveExpression method converts a message parameter value to a...

CVE-2026-92682

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

K000163667: libssh vulnerability CVE-2026-59842

Security Advisory Description A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated...

CVE-2026-102533

Impact Synapse accepts to-device messages from remote homeservers, even if the remote homeserver has spoofed the "sender" field such that it appears to have come from a different homeserver. Homeservers that do not federate or only participate in a closed, trusted federation are not affected...

CVE-2026-102534

Impact Synapse allows users to configure an unbounded number of push rules with an unbounded total size, potentially causing disk space exhaustion. These rules are then loaded back into memory when requested, or when processing push rules for new events, leading to memory exhaustion. Homeservers...

CVE-2026-102595

Impact For some HTTP request paths, Synapse will ignore extraneous path segments and therefore serve a resource at an unexpected path. This could allow evasion of external rate-limiting that may be in place. The Client-Server API "/matrix/client", Federation API "/matrix/federation", Synapse Admi...

CVE-2026-102542

Impact When a remote homeserver requests the event ID of the nearest event to a particular timestamp via the federation ""/timestamptoevent"" https://spec.matrix.org/v1.19/server-server-api/getmatrixfederationv1timestamptoeventroomid endpoint, Synapse does not verify that the requesting homeserve...

Incorrect Authorization

Overview @neo4j/graphql is an A GraphQL to Cypher query execution layer for Neo4j and JavaScript GraphQL implementations Affected versions of this package are vulnerable to Incorrect Authorization via the NONE quantifier in AuthConnectionFilter and AuthRelationshipFilter, which incorrectly behave...

CVE-2026-102535

Impact When a malicious remote homeserver requests missing events using the federation ""/getmissingevents"" https://spec.matrix.org/v1.19/server-server-api/postmatrixfederationv1getmissingeventsroomid endpoint, Synapse does not verify that the requested events are in the room with the given room...

CVE-2026-102532

Impact Via the federation ""/eventauth"" https://spec.matrix.org/v1.19/server-server-api/getmatrixfederationv1eventauthroomideventid endpoint, a malicious remote homeserver can query the authorisation events for an event with a given event ID, without needing to be joined to the room. This is onl...

RHLW-2026-A9AFA2D7B2973961 Lightwell Security Advisory: spring-web 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-web 5.3.18.rhlw-00010 with backported fixes for CVE-2016-1000027, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, and CVE-2024-38820. CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution...

Security update for python310

This update for python310 fixes the following issues: CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection bsc1264962. CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806:...

SUSE-SU-2026:4630-1 Security update for python310

This update for python310 fixes the following issues: - CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection bsc1264962. - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. -...

CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...

CVE-2026-92682

The @neo4j/graphql library (versions 7.0.0 up to but not including 7.6.4 ) contains an incorrect authorization vulnerability where the none quantifier in @authorization filters for relationships and connections fails to negate correctly when translated to Cypher. Consequently, the filter behaves ...

CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefor...