153523 matches found
halo-record v0.2.42
halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your instrumentation captures tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only,...
Exploit for CVE-2026-67401
CVE-2026-67401 — cPanel & WHM EmailTrack SQL Injection → Root...
Security Bulletin:Vulnerabilities exists in NPS of IBM Netezza Appliance
Summary Vulnerabilities identified in NPS of IBM Netezza Software have been addressed in version 11.3.1.3-IF3. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...
Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.
Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway for Multiplatforms, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback, Log4j, Jackson Databind, and various operating system...
Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to Improper Encoding or Escaping of Output
Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34479 Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard,...
Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to ImproperImproper Encoding or Escaping of Output
Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34480 Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including...
Exploit for Allocation of Resources Without Limits or Throttling in Redis
CVE-2021-32675 – Redis Pre-Allocation Denial of Service OOM...
The push to stop algorithms controlling social media feeds has begun
Remember when social media was filled only with posts from your friends, rather than what an algorithm decided you wanted to see? So does the Australian government, and it wants that internet back. Yesterday, the government released draft legislation outlining a Digital Duty of Care. The proposal...
Security Bulletin: IBM Db2 Bridge is vulnerable due to baseline-browser-mapping, sqlparse, cryptography, Browserslist (CVE-2026-45819,CVE-2026-84305,CVE-2026-69247,CVE-2026-73088,CVE-2026-73089,CVE-2026-54284,CVE-2026-59893,CVE-2026-59894,CVE-2026-71491)
Summary baseline-browser-mapping, sqlparse, cryptography, Browserslist is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5 and new Fix pack was release to address the issue. Vulnerability...
K000163263: Go vulnerability CVE-2026-32952
Security Advisory Description go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version...
Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud is using crypto packages which is vulnerable to CVE-2026-32283 and CVE-2026-32281
Summary This release addresses security vulnerabilities in application and operator images of ELM on Hybrid Cloud. The identified vulnerabilities relate to Go standard library packages crypto/tls and crypto/x509, which impact the product within the deployed environment. The vulnerabilities are...
Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)
Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 2.0 have been addressed in version 11.3.1.3-IF4 Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...
Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.
Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to ...
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy...
Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.
Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2021-23369 DESCRIPTION: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming...
Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.
Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2026-49458 DESCRIPTION: DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizenode, INPLACE: true accepted...
Security Bulletin: IBM Cloud Pak for Data System (CPDS 2.0) is affected by an information disclosure vulnerability due to urllib3
Summary urllib3 is used by IBM Cloud Pak for Data System 2.0 as an HTTP client library for Python applications. When HTTP requests are sent without using proxy support, urllib3 versions prior to 1.26.19 and 2.2.2 do not treat the Proxy-Authorization header as sensitive authentication material and...
CVE-2026-53938
A flaw was found in cjose, a C library for Javascript Object Signing and Encryption JOSE. A remote, unauthenticated attacker can exploit a heap buffer overflow vulnerability in the AES Key Wrap decryption process. By submitting a crafted Javascript Web Encryption JWE to an application, the attack...
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport EPP Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 CVSS...