CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in ajv (CVE-2025-69873)

Summary A Regular Expression Denial of Service ReDoS vulnerability in the ajv json-schema validator library CVE-2025-69873 used by IBM InfoSphere Optim Archive Viewer on Windows and Linux platforms has been addressed by upgrading the component versions to 6.14.0, 6.15.0, 8.18.0, and 8.20.0...

BIT-KEYCLOAK-2025-12150 Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

Acelle-Mail-4.2.0-p97-Unauthenticated-SSTI-to-RCE-Chain

Acelle Mail 4.2.0-p97 — Unauthenticated SSTI to RCE Chain V...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

CVE-2026-73570 PoC - SMTP Command Injection Tester A custom,...

The safety penalty: Reclaiming operational sovereignty in the age of AI

As frontier models advance in cyber capability, their guardrails also become more restrictive. Defenders relying on these models to power core SOC processes cannot afford to pay the "safety penalty" of being blocked by these safeguards. Organizations should monitor model refusal rates and use the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-50645, CVE-2026-9322, CVE-2026-9171 , CVE-2026-11541 ,CVE-2026-8408, CVE-2026-11712,...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM DevOps Code ClearCase

Summary IBM HTTP Server IHS is shipped as a component of IBM DevOps Code ClearCase. Information about a security vulnerability affecting IHS has been published in a security bulletin. CVE-2026-29167, CVE-2026-29170, CVE-2026-44186, CVE-2026-34356, CVE-2026-42535, CVE-2026-43951, CVE-2026-44119,...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-9006, CVE-2026-9311, CVE-2026-9330, CVE-2026-10845, CVE-2026-9072, CVE-2026-8858,...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-9072, CVE-2026-8858, CVE-2026-10852 , CVE-2026-8644, CVE-2026-9319, CVE-2026-8646,...

Microsoft SharePoint - Authentication Bypass

Microsoft SharePoint Server Elevation of Privilege Vulnerability id: CVE-2023-29357 info: name: Microsoft SharePoint - Authentication Bypass author: pdteam severity: critical description: | Microsoft SharePoint Server Elevation of Privilege Vulnerability impact: | Unauthenticated attackers can...

Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition for Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint

Summary IBM SDK, Java Technology Edition Quarterly CPU - Jul 2026 - Includes Oracle July 2026 CPU Critical Patch Update CVE-2026-8400, CVE-2026-41254, CVE-2026-47057, CVE-2026-47063, CVE-2026-47058, CVE-2026-16441, CVE-2026-60147, CVE-2026-46968, CVE-2026-16439, CVE-2026-16243, CVE-2026-47027,...

K000163073: curl vulnerability CVE-2026-8925

Security Advisory Description The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free the same pointer twice. CVE-2026-8925 Impact There is no impact; F5 products are not affected by this...

K000163072: Moby vulnerability CVE-2026-34040

Security Advisory Description Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins AuthZ. This issue has been patched in version 29.3.1. CVE-2026-34040 Impact There is no impact; F5...

Qinglong-Combo-Exploit

🐉 Qinglong Combo Exploit Qinglong Panel Three Vulnerabili...

SUSE CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

PT-2026-81299

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A NULL pointer dereference can occur in server or client configurations where RFC7250 Raw Public Keys RPKs are enabled and only a private key is configured locally without an associated...

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

!/usr/bin/env python3 """ CVE-2026-42167 — ProFTPD modsql post-authentication SQL injection - RCE postauthstorrce.py --host --port 21 \ --user --password \ --shell-host --shell-port 4444 SUMMARY ------- ProFTPD's modsql logs FTP activity through user-supplied SQL. Its escaping helper isescapedtex...

Untrusted Sender DN Used as Format String in CMP Response Validation

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

PT-2026-81993

genieacs-mcp exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled Host and Origin headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server accepts the request,...