ROOT-APP-MAVEN-CVE-2025-55752 CVE-2025-55752 in org.apache.tomcat:tomcat-catalina - Patched by Root

Root has patched CVE-2025-55752 in the org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available...

CVE-2026-82058

creationtimestamp| type| source ---|---|--- 2026-09-10 05:16:57+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260910...

Investigating Developer-Reported Software Security Testing Challenges

Software security testing SST is essential for identifying vulnerabilities and improving software security, but developers often face practical challenges when selecting tools, configuring test environments, interpreting scanner outputs, testing authentication workflows, and acting on reported...

PT-2026-89596

Name of the Vulnerable Software and Affected Versions Lenovo Software Fix affected versions not specified Description An authentication bypass allows a local authenticated user to execute arbitrary code with elevated privileges. Recommendations At the moment, there is no information about a newer...

Exploring the Role of Security Experience and ChatGPT Usage Strategies on Secure Software Engineering Education

The rapid adoption of Large Language Models LLMs is reshaping software engineering education, but their role in secure software engineering education remains underexplored. We report an exploratory empirical study of how 26 graduate students in a part-time MSc Cybersecurity programme used ChatGPT...

CVE-2026-63427: Authentication Bypass by Spoofing

An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges...

Chromium: Monthly Vulnerability Update (September 2026)

Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop28.html Work around: No known workarounds exist for this issue...

Malicious code in amprem-activator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bb73ef0a9130c0751f253465a40f102cddb6cecdec2835dd7cc9c0f4150efa1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

RHBA-2024:2413 Red Hat Bug Fix Advisory: glibc bug fix and enhancement update

Bulletin has no description...

Wicked Problem, Parsimonious Solution: Securing Electric Vehicle Charging Station Software

Electric vehicle charging infrastructure presents a suite of novel cyber-physical threats. Among this infrastructure, charging stations are the most vulnerable elements. The software in the charging station supply equipment is particularly vulnerable. Currently, the software is an attack surface...

Security Advisory 0182

Security Advisory 0182 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-86109 CVSSv3.1 Base Score: 6.6...

CVE-2026-71374 Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...

Measuring the Security of the Evolving Software Supply Chain: A Research Agenda

Software supply chain security has become increasingly critical due to the widespread reliance on third-party dependencies and the growing attack surface of modern software ecosystems. However, existing quantitative, measurement-based analysis and vulnerability management approaches remain largel...

CVE-2026-20293: Exposed Dangerous Method or Function

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

CVE-2026-86544

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent...

Malicious code in scw-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f92fe2c0fe1acd783b5612c30ba1976c68c421b6451a68d150928e5166c362e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain

AI coding assistants now select, install, and configure software, and attackers have exploited that position through invented package names, compromised maintainer accounts, and manipulated repository text. In response, the supply-chain community publishes machine-checkable trust signals: softwar...

Palo Alto Networks GlobalProtect App Privilege Escalation

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to the use of an unreliable search path. Exploiting this vulnerability can allow attackers to elevate their privileges to the root level...

MOVEit Transfer - Remote Code Execution

In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...

Signal-iOS v8.27.0.1843

Signal iOS Signal is a free and open source messaging app for simple private communication with friends. Also available on Android and Desktop. Questions? For troubleshooting and questions, please visit our support center or unofficial community forum. Contributing Bug Reports The best way to...