CVE-2026-8166 Stored XSS in Logo Software's e-Logo Purchasing Portal

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...

EUVD-2026-53866

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...

EUVD-2026-53862

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

EUVD-2026-53861

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...

EUVD-2026-53859

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks issuer/subject/audience/time and subjwk binding, enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in...

CVE-2026-64958 Apache CXF: Denial of service via message header attachments

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue...

RHSA-2026:43716 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.17.56 bug fix and security update

Red Hat OpenShift Container Platform release 4.17.56 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

Vulnerabilities in Cisco Catalyst SD-WAN

Cisco has identified several vulnerabilities in Cisco Catalyst SD-WAN. The identified issues include incorrect input validation, incorrect access control, incorrect link resolution before file access, and the storage of sensitive information in cleartext. Due to these vulnerabilities, the softwar...

kin v0.5.5

The diff is not the change. AI agents can write a change faster than a team can establish what it touches, whether it reverses an earlier fix, and how far its consequences reach. Git records files and line history. Kin records the software itself as a graph of entities, relations, changes, and...

On the Figures of Merit for Quantum Software Security: Toward a Benchmarking Rubric

Quantum software is increasingly provided through multi-tenant and cloud-based Quantum-as-a-Service QaaS stacks. A growing concern about the diverse attack vectors across the pipeline has been demonstrated in recent research. Yet the community has converged on three mature pillars: Scale Qubit...

PT-2026-68496

Name of the Vulnerable Software and Affected Versions Loca Software Informatics Technology Ltd. Co. CMS versions prior to 06082026 Description An SQL injection issue exists due to the improper neutralization of special elements used in an SQL command. This allows an attacker to execute arbitrary...

OS Command injection

Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

CVE-2026-18953

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

EUVD-2026-53578

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports...

CVE-2026-17624

CVE-2026-17624 affects IBM Langflow OSS 1.0.0–1.10.3. A remote authenticated attacker could execute arbitrary code due to improper validation of module imports. Documented impact is HIGH (CVE base score 8.5). No exploit details are provided in the available sources. No remediation steps are speci...

CVE-2026-7657

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery SSRF due to incomplete and ineffective SSRF protection enforcement...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70611 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70611 Source advisory: OSV:GHSA-F2R8-JV7C-XQMP...

kin v0.5.3

The diff is not the change. AI agents can write a change faster than a team can establish what it touches, whether it reverses an earlier fix, and how far its consequences reach. Git records files and line history. Kin records the software itself as a graph of entities, relations, changes, and...