CVE-2026-85623

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85693

Chatbot UI (open-source chat application) contains an authorization bypass in its retrieval endpoint (/api/retrieval/retrieve). The root cause is a service-role Supabase client that bypasses row-level security and fails to validate file ownership, allowing any authenticated user to retrieve index...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623

goose v1.37.0 (by aaif-goose) contains an arbitrary command execution flaw in its recipe subsystem. The vulnerable components are stdio extensions and retry.checks within recipes, which are executed without passing through the recipe security scan—creating a bypass for attackers who distribute ma...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-17274: Use of Insufficiently Random Values

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds...

The vulnerability of Apache ActiveMQ software is related to deficiencies in access control, which allow attackers to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of Apache ActiveMQ-related software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

PT-2026-85751

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching...

PT-2026-85759

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds...

CVE-2026-16892: Improper Authentication

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching...

The vulnerability of the Document.createElement() function in the XML document access and manipulation module XMLDOM allows attackers to bypass existing security mechanisms and perform cross-site scripting (XSS) attacks.

The vulnerability of the Document.createElement function in the XML document access and management module, XMLDOM, is related to errors in processing XML requests. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and perform cross-site scripting attacks XSS...

The vulnerability of Fortinet FortiWeb web applications’ network firewalls, related to authentication procedures that allow attackers to bypass existing security restrictions.

The vulnerability of Fortinet FortiWeb network firewalls is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to bypass existing security restrictions remotely...

The vulnerability of the reg() function in the lib/grammar.js module, a module for defining methods to access and manage XML documents, allows attackers to bypass existing security mechanisms.

The vulnerability of the reg function in the lib/grammar.js module, which is used for accessing and managing XML documents, is related to errors in processing XML requests. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

CVE-2026-84762

Unauthenticated Bypass Vulnerability in WP EasyPay = 4.5.3 versions...

composer: Composer: Security bypass allows execution of unauthorized binaries via symlinked paths

A flaw was found in Composer, a dependency manager for PHP. A malicious or compromised dependency can bypass existing security measures designed to prevent unauthorized binary path execution. This can occur when Composer processes untrusted cached data or older build artifacts, allowing it to...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service which are vulnerable to CVE-2026-4410, CVE-2026-5516 This bulletin contains information addressing the vulnerability. Vulnerabili...

KLA91259 Multiple vulnerability in Microsoft Dynamics

Multiple vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to bypass security restrictions, gain privileges. Original advisories CVE-2026-65818 Exploitation Related products Microsoft-Power-Platform CVE list CVE-2026-65818 unknown KB list Solution Insta...

KLA91258 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability can be...

The vulnerability of the reg() function in the lib/grammar.js module, a module for defining methods to access and manage XML documents, allows attackers to bypass existing security mechanisms.

The vulnerability of the reg function in the lib/grammar.js module, which is used for accessing and managing XML documents, is related to errors in processing XML requests. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

CVE-2026-55858

A flaw was found in MariaDB Connector/J, a component used to connect Java applications to MariaDB and MySQL databases. The connector incorrectly assumes a UTF-8 character set for communication, even if the database server changes its client character set to a non-UTF-8 value during a session. Thi...