EUVD-2026-118699

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation...

CVE-2026-17308 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation...

CVE-2026-17308 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation...

cdb

Pown CDB Pown CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of...

CVE-2024-50962

Cross-Site Scripting XSS in DonWeb Ferozo Webmail CVE-2024-50962 Description A Cross-Site Scripting XSS vulnerability in Ferozo Webmail v1.1 allows attackers to execute arbitrary scripts via the Identities and Automatic Responses components. This vulnerability can be used to hijack user sessions,...

CVE-2026-110712

A flaw was found in libsmb2. A malicious Server Message Block SMB server, or an attacker conducting a man-in-the-middle attack on an unsigned network session, can trigger a Denial of Service DoS by returning crafted file information responses with an unchecked file name length. This issue leads t...

CVE-2026-88986

Prior to version 2.15.0 , Kubeflow Pipelines is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events, where the frontend/server/k8s-helper.ts component includes untrusted podname and podnamespace...

CVE-2026-88986

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error...

CVE-2026-75759

A flaw was found in oidcc. This vulnerability allows an unauthenticated attacker to impersonate an arbitrary user. The oidcc component improperly verifies cryptographic signatures in encrypted ID tokens or JSON Web Application Response JARM responses. By exploiting this, an attacker can forge...

urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser

A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...

urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser

A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...

CVE-2026-122301

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Clo...

SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:5062-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5062-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-103399: incomplete request body draining in HTTP/1.x earl...

SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:5063-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5063-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow...

PT-2026-137323

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Clo...

CVE-2026-57566 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it...

CVE-2026-57566 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it...