PT-2026-93222

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A Reflected Cross-Site Scripting issue exists where an attacker can craft a malicious link. If a legitimate user interacts with this link, it may cause the user...

CVE-2026-79425

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

ROS-20260915-73-0201

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

ROS-20260915-73-0103

The vulnerability of the PerformanceAPIs component in Google Chrome and Microsoft Edge relates to improper protection against attacks through external physical channels. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML...

CVE-2026-56888: Observable Discrepancy

In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-92309

In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-92167

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...

ROS-20260915-73-0133

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

EUVD-2026-78941

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

ROS-20260915-73-0154

The vulnerability of the Scroll component in Google Chrome and Microsoft Edge is related to improper protection against attacks through external physical channels. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

PT-2026-92058

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

From Hypervisor to Container: Cloud Security Vulnerabilities, Defense Mechanisms, and Open Challenges

In cloud computing, different users share the same physical hardware, which creates serious security risks. To protect data, cloud systems rely on virtual machines and containers to keep users isolated. This paper reviews over 120 security publications from 2008 to 2025, focusing on how these...

CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-91199

Refly (versions through 1.1.0) is affected by a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint fetches caller-supplied URLs without validating the scheme, host, or resolved address, allowing authenticated attackers to make the backend issue req...

CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

Security Bulletin: Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

Summary A security vulnerability was identified in the code security scanner where the DANGEROUSIMPORTS blocklist incompletely addressed network-based code execution risks. While subprocess module imports were correctly blocked, socket and urllib standard library modules were omitted from the...

CVE-2026-75792

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...

CVE-2026-13275

IBM MQ Managed File Transfer is vulnerable to XML External Entity (XXE) injection in reply message processing (CWE-611). An authenticated attacker can exploit this to read arbitrary files or perform server-side request forgery (SSRF) . Affected versions span 9.1 LTS (≤9.1.0.37), 9.2 LTS (≤9.2.0.4...

CVE-2026-13275 IBM MQ Managed File Transfer is vulnerable to XML external entity injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform...

CVE-2026-13275 IBM MQ Managed File Transfer is vulnerable to XML external entity injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform...