GHSA-F8G7-2XJC-7MFH rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

GHSA-3G9Q-V48F-HH9W Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

GHSA-4QPV-39HG-F7FX @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

GHSA-4X45-GXVP-6283 @argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

@argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS

Unbounded Remote Media Fetch and Video Frame Expansion DoS Summary The POST /v1/chat/completions endpoint in mistral.rs fetches attacker-supplied media URLs image, audio, video into server memory with no byte limit, and extracts every frame of a supplied video when numframes is None. An...

GHSA-M3WP-48JR-VR4G mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS

Unbounded Remote Media Fetch and Video Frame Expansion DoS Summary The POST /v1/chat/completions endpoint in mistral.rs fetches attacker-supplied media URLs image, audio, video into server memory with no byte limit, and extracts every frame of a supplied video when numframes is None. An...

Exploit for Stack-based Buffer Overflow in Microsoft

🛡️ AI Security Tool Module CVE-2026-4...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in bcprov-jdk18on-1.82 (CVE-2026-0636)

Summary IBM® Db2® federated server is affected by a vulnerability in bcprov-jdk18on-1.82 CVE-2026-0636 Vulnerability Details CVEID:CVE-2026-0636 DESCRIPTION: Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Legion of the Bouncy Castle Inc. BC-JAV...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in fabric-sdk-java (CVE-2026-41586)

Summary IBM® Db2® federated server is affected by a vulnerability in fabric-sdk-java Vulnerability Details CVEID:CVE-2026-41586 DESCRIPTION: Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26...

Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.

Summary IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries. Vulnerability Details CVEID:CVE-2026-55831 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final,...

K000163298: Linux kernel vulnerability CVE-2026-53397

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak on SETACL decode failure nfsaclsvcdecodesetaclargs and nfs3svcdecodesetaclargs each call nfsstreamdecodeacl twice, first for NFSACL and then for NFSDFACL. Each successful call...

Security Bulletin: IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions (CVE-2026-86093)

Summary IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds...

Security Bulletin: IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference (CVE-2026-16702)

Summary IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference CVE-2026-16702 Vulnerability Details CVEID:CVE-2026-16702 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a remote...

GHSA-7GHQ-V6JF-G56C Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

brutus v1.15.0

Brutus "Et tu, Brute?" — The last words before credentials fall. Modern credential testing tool in pure Go Installation • Quick Start • Pipeline • Protocols • Enumeration • Proxy • Library Overview Brutus is a multi-protocol authentication testing tool designed to address a critical gap in...

Security Bulletin: Updating Java in Identity Insight 9.0.0.1 for security update

Summary Identity Insight customers are advised to update OpenJDK 8 to version 8.0.504 for the security update in Java. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM InfoSphere...