PT-2026-81850

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

PT-2026-81163

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress create page AJAX action. The LP Admin Ajax::create page handler only checks the edit pages capability and a wp rest nonce both...

PT-2026-81169

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp featured video url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-81307

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description An issue exists in the Certificate Management Protocol CMP password-based MAC protection verification. The library uses the X509 ALGOR get0 function to read the protectionAlg algorithm...

Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

Linux Distros Unpatched Vulnerability : CVE-2026-63076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the jsonValue function when user-controlled data is supplied to the jsonPath parameter with PostgresDriver. An attacker can execute arbitrary SQL commands by injecting malicious input. Remediation Upgrade...

SQL Injection

Overview cakephp/cakephp is a rapid development framework for PHP which uses commonly known design patterns like Associative Data Mapping, Front Controller, and MVC. Affected versions of this package are vulnerable to SQL Injection via the jsonValue function when user-controlled data is supplied ...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2024-34459...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in jackson-databind [CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in jackson-databind CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515. Jackson-databind is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediati...

CVE-2020-37268

A flaw was found in Coq and Rocq provers. The Print Assumptions feature, which is used to audit the soundness of proofs, fails to report when a definition was created without proper "universe checking" a mechanism to ensure logical consistency. This occurs when the definition is incorporated...

DEBIAN-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

UBUNTU-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2022-30983

A cross-site scripting XSS vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parameter...

Remote Code Execution (RCE)

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions,...

Remote Code Execution (RCE)

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions, CustomResolver.isPathAllowed, and...

External Control of Assumed-Immutable Web Parameter

Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter through WebsocketConstants and the AtmosphereWebsocketEndpointBuilderFactory/WebsocketProducer dispatch headers in the atmosphere-websocket producer. An attacker can redirect or suppre...

CVE-2026-77635

CakePHP , a PHP rapid development framework, is affected by a SQL injection in FunctionsBuilder::jsonValue() when used with PostgresDriver. The vulnerability occurs when user-controlled data is supplied to the jsonPath parameter, allowing an unauthenticated remote attacker to inject arbitrary SQL...