Security Bulletin: IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

Summary IBM SDK Java Technology Edition and IBM Runtime Environment Java used by IBM i to support the building and running of Java applications are vulnerable to multiple vulnerabilities CVE-2026-16441, CVE-2026-46917, CVE-2026-47063, CVE-2026-60147, CVE-2026-41254, CVE-2026-47057, CVE-2026-47058...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to Authentication Bypass by Spoofing [CVE-2026-18065]

Summary The IBM Db2 Mirror for i GUI is vulnerable to Authentication Bypass by Spoofing CVE-2026-18065 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18065 DESCRIPTION: IBM i could allow a remote unauthenticated attacker to gain access to sensitive...

CVE-2026-22243

CVE-2026-22243：EGroupware 在 Nextmatch 过滤器处理中存在 SQL 注入漏洞 概述 字段| 详情 ---|--- CVE 编号| CVE-2026-22243 严重级别| 高危 安全公告| 查看公告 发现者| Lukasz Rybak 受影响产品 egroupware/egroupware （版本：= 26.0.20251208， $val...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery [CVE-2026-17047]

Summary The IBM Db2 Mirror for i GUI is vulnerable to Cross-Site Request Forgery CVE-2026-17047 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17047 DESCRIPTION: IBM Db2 Mirror for i could allow a remote attacker to obtain sensitive information due to...

ubercookie

🍪 ubercookie 一个教育性演示，展示网站如何持续识别你——以及为什么“清除 cookie”已经不够了。 ubercookie 将单个随机 id 同时植入 12 种不同的浏览器存储载体。每次你访问时，它都会读取所有载体、进行共识判断，并将该 id 重新写回所有位置。清除任意一个存储——甚至清除全部 cookie——幸存者也会悄悄地将它 复活 。该网站会用通俗的语言告诉你，你的 id 藏在哪些地方，以及它识别出你的浏览器的次数。 这与 Samy Kamkar 经典的 evercookie 背后的理念相同——在此构建为一个开放、透明的教学工具，专注于存储复活与超级 cookie 持久...

CVE-2026-88877

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to cert-manager ( CVE-2026-25518 )

Summary Potential vulnerabilities in cert-manager package CVE-2026-25518 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-25518 DESCRIPTION: cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service, improper input validation, and race condition due to Kubernetes (CVE-2025-0426, CVE-2025-1767, CVE-2024-7598)

Summary Potential vulnerabilities in kubernetes package CVE-2025-0426, CVE-2025-1767, CVE-2024-7598 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-0426 DESCRIPTION: A security issue was discovered in Kubernetes where a large number of container...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to weak randomness due to undici (CVE-2025-22150)

Summary Potential vulnerabilities in undici package CVE-2025-22150 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-22150 DESCRIPTION: Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici us...

CVE-2026-52680_exploit

CVE-2026-52680 — Apache Kyuubi REST 批处理路径遍历任意文件写入 在 Apache Kyuubi 的 REST API 中，通过 multipart 批量提交端点 可实现未经认证的任意文件写入。 POST /api/v1/batches（multipart/form-data）会将 resourceFile 部分写入 $KYUUBIHOME/work/upload//，使用的是客户端提供的文件名 ，且没有 路径遍历检查（kyuubi-common 的 Utils.writeToTempFile）： root@kitploit: val filePath ...

CVE-2026-22020-Weak-Seed-in-Quantum-Key-Distribution-Error-Correction

CVE-2026-22020 – 量子密钥分发纠错中的弱种子 程序代码（Python） root@kitploit: qkdweakseed.py - Simulated QKD privacy amplification with weak seed import hashlib, os, time def privacyamplificationsiftedkey, seed: Weak: seed derived from current time, predictable if seed is None: seed = strtime.time.encode return...

CVE-2026-88877

This CRITICAL (CVSS 3.1: 9.8) vulnerability affects Traefik v3.7.0 through v3.7.11, specifically its Kubernetes ingress-nginx provider . When an Ingress carries both an authentication annotation and the from-to-www-redirect annotation, the provider creates a "sibling" router that matches on host ...

EUVD-2026-75427

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

ClaimJumper

root@kitploit: / | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 专业的 JWT 安全测试工具包。内置 15+ 项漏洞检查、10 万级密钥字典及针对特定 CVE 的攻击能力，可分析、破解、伪造和利用 JSON Web Token。 功能特性 核心分析 JWT 解码与漏洞扫描 15+...

CVE-2021-44228

🛡️ CVE-2021-44228: Log4Shell 分析 - 颠覆 Java 安全的漏洞 关键影响 CVSS 10.0 | 发现于2021年，Apache Log4j 中的这一缺陷允许远程代码执行 RCE，影响全球数百万系统。即使在今天，它仍然是网络安全领域的关键警示！ 🔍 什么是 Log4Shell？ CVE-2021-44228 ，被称为 Log4Shell ，是 Apache Log4j 2 日志库中的一个 远程代码执行 RCE 关键漏洞。该缺陷允许恶意攻击者仅通过发送应用程序记录的特制文本字符串，即可在易受攻击的服务器上执行任意代码。 为何如此危险？ Log4j 在 Java...

dtls-fuzzer

dtls-fuzzer は、DTLSサーバのプロトコル状態ファジングを実行するJavaツールです。具体的には、以下の機能をサポートしています： 1. アルファベットを指定すると、ローカルのDTLSサーバ実装のモデルを自動的に生成できます。 2. テスト（入力のシーケンス）とアルファベットを指定すると、DTLSサーバ実装上でテストを実行できます。 3. 複数の学習実行を含むバッチ学習タスクを実行できます。 dtls-fuzzer は TLS-Attacker を使用して、DTLSメッセージの生成/解析と状態の維持を行います。 そのために、TLS-Attacker...