May 2026 Security Advisory Ivanti Virtual Traffic Manager (vTM) (CVE-2026-8051)

Summary Ivanti has released updates for Ivanti Virtual Traffic Manager which addresses one High severity vulnerability. Successful exploitation could lead to admin authenticated remote code execution. We are not aware of any customers being exploited by this vulnerability at the time of disclosur...

Security Advisory Ivanti Endpoint Manager (EPM) May 2026

Security Advisory Ivanti Endpoint Manager EPM CVE-2026-8109, CVE-2026-8110, CVE-2026-811 Summary Ivanti has released updates for Ivanti Endpoint Manager which addresses one Medium severity and two High severity vulnerabilities. Successful exploitation could lead to information disclosure, privile...

CVE-2026-90436

A flaw was found in Apache Axis. An unauthenticated remote attacker can exploit an insecure deserialization issue by sending a specially crafted Simple Object Access Protocol SOAP fault message. Because the message is parsed and classes are instantiated before authentication handlers are evaluate...

CVE-2026-128083

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled byt...

Laravel: Task Output Injection - Concurrency Process

Summary If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions Pre-reqs Insecure code and insecure handling of user provided input devs trust user-provided input : 1. App has a route...

GHSA-63HM-G96R-2M2Q Laravel: Task Output Injection - Concurrency Process

Summary If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions Pre-reqs Insecure code and insecure handling of user provided input devs trust user-provided input : 1. App has a route...

EUVD-2026-125699

Laravel: Task Output Injection - Concurrency Process...

CVE-2026-128083 Laravel: Task Output Injection - Concurrency Process

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled byt...

CVE-2026-128083

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled byt...

CVE-2026-104204

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1.7.0...

CVE-2026-62977

The BACnet Stack C library for embedded systems contains a vulnerability in its FILE object implementation prior to versions 1.5.1 and 1.6.0 . The issue allows remote WriteProperty(PROP_FILE_SIZE) requests to modify the size of a stream-access FILE object without verifying if the file is marked R...

Malicious code in testing1345 (PyPI)

Source: kam193 15bab830cd8343859ac220ef87e821719169a4e2ccb50da37032d97ef02c27dd During installation, the package downloads and executes a script from a remote location. The server delivers different payload versions, some of them being benign, and others containing next-stage installation. The...

CVE-2026-97358 Inclusion of Web Functionality from an Untrusted Source on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus

An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom...

CVE-2026-97358

CVE-2026-97358 involves the inclusion of web functionality from an untrusted source , which could lead to remote code execution on SpaceCom devices. Specifically, the vulnerability affects B. Braun SpaceCom , the Battery Pack SP with Wi-Fi , and the Data module compactplus . While the base severi...

EUVD-2026-125685

An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom...

CVE-2026-129171

The NginxPulse monitoring tool (versions prior to 1.6.26 ) is vulnerable to an unauthenticated SQL injection via the /api/stats/:type endpoint. The root cause is the improper handling of the id and locationType parameters, which allows remote attackers to append SQL commands. Impact includes the ...

EUVD-2026-125596

NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents,...

EUVD-2026-125591

A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026...

CVE-2026-123965

The Jet Admin Cloud Platform is affected by a prompt injection vulnerability across all versions. This flaw allows a remote attacker possessing a free account to expose sensitive .env configuration files and exfiltrate critical credentials. The vulnerability was mitigated via a sandbox component ...

CVE-2026-124041

The Catalis/Patriot Properties WebPro 5.0 software is vulnerable to an SQL Injection vulnerability (CWE-89). This flaw allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database . The primary impact is the potential exfiltration of sensitive pr...