Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which could provide weaker than expected security, is affected by a privilege escalation vulnerability and server-side request forgery, requests-2.32.4-py3-none-any.whl which are vulnerable to...

CVE-2026-50184

A flaw was found in the @angular/service-worker component. When the Angular Service Worker reconstructs network requests, it inadvertently removes client-defined security settings for credentials and HTTP caching. This can cause the browser to send sensitive credentials, such as cookies or...

EUVD-2026-42155

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearb...

CVE-2026-60104: Authorization Bypass Through User-Controlled Key

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryptio...

PT-2026-56445

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...

PT-2026-56582

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.3 NATS Server versions prior to 2.12.12 Description A WebSocket listener may route requests for the MQTT-over-WebSocket path to MQTT handling processes even if MQTT is not configured. This allows an...

ROS-20260708-73-0026

The vulnerability of the Grafana Live messaging system in real-time mode, a platform for monitoring and surveillance, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially crafted...

ROS-20260708-73-0028

The vulnerability of the Grafana monitoring and observation platform’s plugin is related to the unlimited distribution of resources when processing requests to the endpoint. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

PT-2026-56407

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-59702: Server-Side Request Forgery (SSRF)

repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers t...

IBM Watsonx.Data Intelligence Server Request Forgery Vulnerability (CNVD-2026-28621)

IBM WatsonXData Intelligence is a data management and analysis platform provided by American company IBM. IBM WatsonX.Data Intelligence has a server-side request forgeing vulnerability. This vulnerability arises from the lack of sufficient verification mechanisms on the server to confirm the orig...

PT-2026-56486

Name of the Vulnerable Software and Affected Versions repomix affected versions not specified Description A server-side request forgery SSRF issue exists in the 'POST /api/pack' endpoint. This occurs because the endpoint does not properly validate http://, https://, and file:// URLs before they a...

IBM Watsonx.Data Intelligence Resource Management Error Vulnerability

IBM WatsonXData Intelligence is a data management and analysis platform provided by American company IBM. There is a resource management vulnerability in IBM WatsonX.Data Intelligence, which stems from uncontrolled resource consumption within the application. Attackers can exploit this...

buildah security update

1.43.1-1.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.43.1-1 - update to the latest content of https://github.com/containers/buildah/tree/release-1.43 https://github.com/containers/buildah/commit/c6eb14c - fixes 'Buildah concurrent bearer token requests...

ROS-20260708-73-0060

The vulnerabilities of the jvpstringappend and jvpstringcopyreplacebad functions, which are used to process JSON files in jq, are related to integer overflow. Exploiting these vulnerabilities could allow an attacker to cause a service failure by sending a specially crafted request...

Linux Distros Unpatched Vulnerability : CVE-2026-59153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its...

Moderate: cups security update

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network CVE-2026-34980 For more details about...

PT-2026-56679

Name of the Vulnerable Software and Affected Versions zalando/skipper versions prior to 0.26.10 Description The OpenPolicyAgent integration in zalando/skipper contains a flaw that allows request-body inspection to be bypassed. This occurs during HTTP/1.1 requests using Transfer-Encoding: chunked...

PT-2026-56437

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data...

PT-2026-56552

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.6.0 Description An issue exists where the server fails to verify if the email address provided in the body of the 'POST /auth-requests/admin-request' endpoint belongs to the authenticated user. This allo...