PT-2026-97353

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description An unauthenticated adjacent-network attacker can achieve remote code execution by delivering a crafted serialized payload to the PayDir...

PT-2026-97426

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.38.0-3.1 Description The httpd component in BusyBox handles IP deny rules incorrectly when invalid CIDR prefix lengths are provided. This causes the system to fail open, resulting in a parsed IP with a zeroed mask,...

PT-2026-105035

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

PT-2026-97364

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Missing authentication on the Business Rules Manager commands REST endpoint allows a local actor to invoke unauthenticated commands. This ca...

CVE-2026-93508: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

PT-2026-97315

Name of the Vulnerable Software and Affected Versions Forcepoint Security Engine NGFW versions 7.1.0 through 7.1.13 Forcepoint Security Engine NGFW versions 7.3.0 through 7.3.1 Forcepoint Security Engine NGFW version 7.3.3 Forcepoint Security Engine NGFW versions 7.4.0 through 7.4.1 Forcepoint...

bazel-rules-python-source-2.3.3-1.1 on GA media (moderate)

bazel-rules-python-source-2.3.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11831-1 Rating: moderate Cross-References: CVE-2025-47273 CVSS scores: CVE-2025-47273 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2025-47273 SUSE : 7.7...

CVE-2026-63116

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

SUSE CVE-2026-56743

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

100DaysofYARA

100 Days of YARA 2026 100 Days of YARAへようこそ！このリポジトリは、この期間に作成されたすべてのYARAアイデアを保存する場所として機能します。作成した楽しいスクリプト、ツール、ルールはすべてこのGitHubリポジトリにコミットできます！当面は、関連するブログ記事、ウォークスルー、その他の考察は別の場所で公開してください : これっていったい何なの？ 簡単に言うと、100DaysofYARA...

PT-2026-96276

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.6.15 Joplin versions prior to 3.7.2 Description In the packages/renderer/MdToHtml/rules/fountain.ts file, HTML generated by the vendored fountain.js renderer is passed into the note output without sanitization. This...

CVE-2026-55105: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain...

PT-2026-96247

Name of the Vulnerable Software and Affected Versions Joplin versions 1.4.0 through 3.7.1 Description In the packages/renderer/MdToHtml/rules/katex.ts file, the application enables the trust option for KaTeX note content. This allows an author to insert a href URL into the rendered output that...

PT-2026-96169

Name of the Vulnerable Software and Affected Versions deepstream version 10.1.0 Description An issue exists where the src/services/permission/valve/rules-map.ts file omits RECORD ACTION.PATCH MULTI from the RULES MAP. When an authenticated user performs a PATCH MULTI record operation while the...

CVE-2026-63116: Missing Authorization

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

OPENSUSE-SU-2026:11831-1 bazel-rules-python-source-2.3.3-1.1 on GA media

These are all security issues fixed in the bazel-rules-python-source-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-63451 Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make...