CVE-2026-108756 Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...

CVE-2026-98248

A flaw was found in the Linux kernel's arm64 per-CPU memory operations. When performing atomic operations on 8-bit and 16-bit variables using Large System Extensions LSE, the assembly instructions fail to specify the proper size suffix, erroneously reading and writing 32 bits of memory. A local...

PT-2026-110158

Name of the Vulnerable Software and Affected Versions Abilityai Trinity versions prior to 0.9.6 Description A missing authorization issue exists in the Telegram router. This allows agent-scoped MCP API keys to execute binding operations that should be restricted to humans. An attacker who gains...

CVE-2026-108756: Missing Authorization

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...

Log4Jolokia

Log4Jolokia Descrizione: Implementazione Python3 per sfruttare gli MBean di Log4J tramite Jolokia Utilizzo: Aiuto generico: usage: log4jolokia.py -h -u USER -p PASSWD --proxy PROXY -H HEADER execjar,writefile,readfile,execscript execjar,writefile,readfile,execscript ... target target ... position...

CLEANSTART-2026-TF05670 Out-of-bounds memory operations in org

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

CVE-2026-107821

A flaw was found in MariaDB. An attacker able to place a crafted table format FRM metadata file into the database data directory can exploit insufficient validation of metadata boundaries and field counts when the server opens the file. This could lead to out-of-bounds memory operations,...

EUVD-2026-95898

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

linux-malware-detect

Linux Malware Detect LMD Scanner di malware per Linux — rilevamento delle minacce multi-stadio MD5, SHA-256, HEX, YARA, analisi statistica, integrazione con ClamAV, monitoraggio in tempo reale tramite inotify, operazioni di quarantena/pulizia/ripristino e alerting multi-canale email, Slack,...

Micro Focus Operations Bridge Reporter - Remote Code Execution

Micro Focus Operations Bridge Reporter 10.40 is susceptible to remote code execution. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. id: CVE-2021-22502 info: name: Micro Focus...

EUVD-2026-95324

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

PT-2026-108963

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Nginx UI contains a cross-site request forgery CSRF flaw where the AuthRequired middleware accepts a browser-managed cookie named token as a valid API credential. Because management endpoints d...

CVE-2026-107811: Exposure of Sensitive Information to an Unauthorized Actor

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

CVE-2026-93860

A flaw was found in OpenStack Mistral. The maintenance API endpoint is missing an authorization check, allowing any authenticated user to activate global maintenance mode on the Mistral service. When an attacker triggers maintenance mode, all write operations workflow execution creation,...

CVE-2026-84249

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

EUVD-2026-44636

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend...

CVE-2026-84249 IBM Guardium Data Protection is affected by vulnerability

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

CVE-2026-84249

IBM Guardium Data Protection versions 12.2 and 12.2.2 are affected by a CRITICAL vulnerability (CVSS 9.8) caused by missing authentication for critical functions (CWE-306). This flaw could allow a remote attacker to execute arbitrary management operations without any privileges or user interactio...

Malicious code in node-env-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...

EUVD-2026-94860

Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows,...