Security Bulletin: XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36431)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed XSS vulnerability. Vulnerability Details CVEID:CVE-2025-36431 DESCRIPTION: IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.01 is vulnerable to cross-site...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub had vulnerabilties which were resolved. - fastapi, follow-redirects, dompurify, bn.js, elliptic, form-data, js-yaml, poetry, golang.org/x/text, transformers, qs, langchain, brace-expansion, echarts, golang.org/x/sys,...

SPIPScan

SPIPScan Scanner SPIP CMS per scopi di penetration testing scritto in Python e rilasciato sotto licenza MIT. Questo strumento è stato progettato per eseguire il rilevamento delle installazioni SPIP durante il penetration testing. Attualmente, lo strumento rileva la versione dell'installazione SPI...

NINJA-PingU

NINJA PingU NINJA-PingU Is Not Just a Ping Utility è uno strumento di scansione di rete open source, gratuito e ad alte prestazioni, pensato per analisi su larga scala. È stato progettato con le prestazioni come obiettivo principale e sviluppato come framework per consentire una facile creazione ...

EUVD-2026-67198

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-59316 Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-59316 Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-59316

CVE-2026-59316 is a stored XSS vulnerability in Spring Authorization Server 's DefaultConsentPage . User-controlled values from an OAuth2 authorization request are rendered without HTML entity encoding, allowing an attacker to inject malicious scripts that execute when the consent page is present...

CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

EUVD-2026-67177

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

CVE-2026-59288

Spring for GraphQL (org.springframework.graphql:spring-graphql) versions 2.0.0–2.0.4 , 1.4.0–1.4.6 , 1.1.0–1.3.9 , and 1.0.0–1.0.7 are vulnerable to a Cross-Site Request Forgery (CSRF) issue via the bundled GraphiQL page. An attacker can share a malicious URL that, when visited by a user with an ...

CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

EUVD-2026-67175

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

CVE-2026-59286 Spring for GraphQL loads Untrusted Resources in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring...

CVE-2026-59286

Spring for GraphQL (versions 2.0.0–2.0.4, 1.4.0–1.4.6, 1.1.0–1.3.9, and 1.0.0–1.0.7) is affected by an unsafe dependency resolution issue in its bundled GraphiQL page, which loads JavaScript libraries from a public CDN without Subresource Integrity checks. An attacker who compromises the CDN or i...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.323 Vulnerability Details CVEID:CVE-2026-48776 DESCRIPTION: LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python...

PCI DSS 4.0.1: Application Requirements You’re Being Assessed On in 2026

Key Takeaways Since March 31, 2025, all 51 former “best practice” requirements in PCI DSS 4.0 have been fully scored. Every 2026 assessment covers them. A large share of the new weight sits in the PCI DSS 4.0.1 application requirements , concentrated in Requirements 6 and 11: inventory of custom...

CVE-2026-31431-copy-fail

Exploit CVE-2026-31431 Copy Fail Parte 1: Concetto Teorico Come funziona CVE-2026-31431 Invece di recuperare costantemente i file direttamente dal lento disco rigido fisico—il che spreca molto tempo—il sistema Linux crea una copia temporanea del file nella RAM, nota come Page Cache. Ciò consente ...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81100

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...