Security Bulletin: IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures

Summary IBM ContextForge MCP Gateway includes regexfilter and denyfilter plugins that operators configure as security controls for PII redaction, secret scrubbing, prompt-injection filtering, and forbidden-content blocking. These plugins contain a filter bypass vulnerability CVE-PENDING where the...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses jackson-databind-2.21.2.jar, dompurify-3.4.11.tgz, requests-2.32.5-py3-none-any.whl, dompurify-3.4.2.tgz, pyjwt-2.12.1-py3-none-any.whl, and js-yaml-3.14.2.tgz which is vulnerable to CVE-2026-59888, CVE-2026-59889, CVE-2026-66010, CVE-2026-25645,...

CVE-2026-80693

A flaw was found in the Linux kernel's idpf component. A privileged control plane such as a Physical Function or a hypervisor device model could exploit a vulnerability by providing a malformed reply to an interrupt-vector allocation request. This malformed reply, where the sum of per-chunk vecto...

CVE-2026-80648

A flaw was found in the pinctrl pin controller driver for SpacemiT systems in the Linux kernel. An incorrect NULL check in the spacemitpinsetconfig function can lead to a NULL pointer dereference. This occurs when the system attempts to configure a pin that is not present in the SoC's pin table,...

CVE-2026-80628

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sequencer OSS Open Sound System emulation. A local user could exploit a data race condition when the sndseqossreadqclear function resets the read queue state without proper locking. This can lead to stale records, dropp...

CVE-2024-41453_CVE-2024-41454

CVE-2024-41453 CVE-2024-41454 ProcessMaker Vulnerabilites just for education: @ryancooley @velkymx @nolanpro @caleeli install ProcessMaker 4 Core Docker Instance frome this repository: https://github.com/ProcessMaker/pm4core-docker this is latest pm docker version PMVERSION=4.1.21, below image is...

CVE-2026-82668 klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-82668 klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

EUVD-2026-68452

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-82668

klaussilveira GitList 2.0.0 is affected by an OS command injection vulnerability in the getDefaultBranch function of the Git Command Line component (src/SCM/System/Git/CommandLine.php). The attack is remotely exploitable with no authentication or user interaction required. A proof-of-concept expl...

CVE-2026-82668 klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

test-fuzz

test-fuzz test-fuzz は、afl.rs を使ったファジングに関連する特定のタスクを自動化するための Cargo サブコマンドおよび Rust マクロのコレクションです。具体的には以下を含みます: ファジングコーパスの生成 ファジングハーネスの実装 test-fuzz は、これらのタスクを部分的に Rust のテスト機能を利用して実現します。たとえば、ファジングコーパスを生成するために、test-fuzz は cargo test の実行中に対象関数が呼び出されるたびに、その引数を記録します。同様に、test-fuzz はファジングハーネスを、cargo-test...

CVE-2026-80621

A flaw was found in the Linux kernel's PCI DesignWare Cores DWC driver. When the controller lacks RAS DES capability, the dwcpcierasdesdebugfsinit function can incorrectly report success, leaving a pointer uninitialized. During debugfs teardown, the dwcpcierasdesdebugfsdeinit function then attemp...

CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

EUVD-2026-68401

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery (SSRF) vulnerability in the getB64BasePdf function. When the basePdf template field is attacker-controlled, the function fetches arbitrary URLs without validation, allowing attackers to force servers or clients to request internal...

CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

EUVD-2026-68436

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...

CVE-2026-82667 yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...

CVE-2026-82667

This vulnerability affects yaojingang GEOFlow versions up to 2.1.0 . The server-side request forgery (SSRF) is triggered in the function DistributionController.isValidHttpEndpoint within app/Services/GeoFlow/GenericHttpEndpointResolver.php through manipulation of the endpoint_url argument. The at...