CVE-2026-24798

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine prog/3rdPartyLibs/miniupnpc modules. This vulnerability is associated with program files upnpreplyparse.C. This issue affects DagorEngine: through dagor20250115...

CVE-2026-24797

Out-of-bounds Write vulnerability in neka-nat cupoch thirdparty/libjpeg-turbo/libjpeg-turbo modules. This vulnerability is associated with program files tjbench.C. This issue affects cupoch...

CVE-2026-24814 A integer overflow in swoole/swoole-src

Integer Overflow or Wraparound vulnerability in swoole swoole-src thirdparty/hiredis modules. This vulnerability is associated with program files sds.C. This issue affects swoole-src: before 6.0.2...

CVE-2026-24814

CVE-2026-24814 is an Integer Overflow or Wraparound vulnerability in swoole-src (thirdparty/hiredis modules), associated with program files sds.C. Affected: swoole-src before 6.0.2. Root cause details and remediation are not specified in the provided documents; no exploit details are given. Monit...

PT-2026-4866

Out-of-bounds Write vulnerability in neka-nat cupoch third party/libjpeg-turbo/libjpeg-turbo modules. This vulnerability is associated with program files tjbench.C. This issue affects cupoch...

Security Bulletin: Enterprise Content Managemant System Monitor for December 2025 - multiple CVEs

Summary Enterprise Content Management System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

TikTok Forms U.S. Joint Venture to Continue Operations Under 2025 Executive Order

TikTok on Friday officially announced that it formed a joint venture that will allow the hugely popular video-sharing application to continue operating in the U.S. The new venture, named TikTok USDS Joint Venture LLC, has been established in compliance with the Executive Order signed by U.S...

New Research Exposes Critical Gap: 64% of Third-Party Applications Access Sensitive Data Without Authorization

Boston, MA, USA, 21st January 2026, CyberNewsWire...

EUVD-2026-3712

Malicious code in jquery-ajaxchimp npm...

Oracle Critical Patch Update Advisory - January 2026

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches add...

Five Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts

Cybersecurity researchers have discovered five new malicious Google Chrome web browser extensions that masquerade as human resources HR and enterprise resource planning ERP platforms like Workday, NetSuite, and SuccessFactors to take control of victim accounts. "The extensions work in concert to...

ScienceLogic SL1 10.1.x < 12.1.3 / 12.2.x < 12.2.3 (CVE-2024-9537)

The version of ScienceLogic SL1 formerly EM7 installed on the remote host is prior to 12.1.3, 12.2.3, or 12.3. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9537 advisory. - ScienceLogic SL1 is affected by an unspecified vulnerability involving an unspecified...

SpyCloud Launches Supply Chain Solution to Combat Rising Third-Party Identity Threats

New monitoring capability delivers unprecedented visibility into vendor identity exposures, moving enterprises and government agencies from static risk scoring to protecting against actual identity threats...

New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification

Research analyzing 4,700 leading websites reveals that 64% of third-party applications now access sensitive data without business justification, up from 51% in 2024. Government sector malicious activity spiked from 2% to 12.9%, while 1 in 7 Education sites show active compromise. Specific...

OPENSUSE-SU-2026:20029-1 Security update for gpg2

This update for gpg2 fixes the following issues: - CVE-2025-68973: out-of-bounds write when processing specially crafted input in the armor parser can lead to memory corruption bsc1255715. Other security fixes: - gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures bsc1256246. - gpg...

Improper Authentication

allauth-django is vulnerable to improper authentication. The vulnerability is due to the use of the mutable preferredusername attribute as the identifier for third-party provider accounts, which allows an attacker to change this value and potentially impersonate or gain unauthorized access to...

CVE-2026-0500

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager WorkStation, an unauthenticated attacker could create a malicious JNLP Java Network Launch Protocol file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope...

SAP Wily Introscope Enterprise Manager 代码注入漏洞

SAP Wily Introscope Enterprise Manager is an application performance management component from SAP, Germany. A code injection vulnerability exists in SAP Wily Introscope Enterprise Manager, which stems from the use of a vulnerable third-party component, and could allow an unauthenticated attacker...

CVE-2025-69275

Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps Spectrum: 24.3.9 and earlier...

Broadcom DX NetOps Spectrum 安全漏洞

Broadcom DX NetOps Spectrum is a network fault management and condition monitoring platform from Broadcom Corporation USA. A security vulnerability exists in Broadcom DX NetOps Spectrum version 24.3.9 and earlier, which stems from a dependency on a vulnerable third-party component and could lead ...