Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to Cryptographic Weakness in IBM Liberty Server ( CVE-2020-36732)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the cryptographic weakness vulnerability Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an intege...

CVE-2026-81527

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those...

CVE-2026-81527 NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those...

CVE-2026-81527

CVE-2026-81527 is a NoSQL/expression injection flaw in the MongoDB C# Driver , specifically in the LINQ-to-aggregation query translation layer affecting both aggregation expression and query filter translation. The root cause is that unquoted constant GroupBy keys in LINQ pipeline translation are...

EUVD-2026-67211

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those...

CVE-2026-59276

Spring Security is affected by a timing attack vulnerability in several components that compare security-sensitive values using standard String.equals() instead of a constant-time comparison. Because String.equals() returns as soon as a differing character is found, the response time for rejectin...

CVE-2026-66353

woylie doggo (an Elixir/Phoenix ecosystem library) contains a Reflected XSS in Doggo.normalize_value/2 (lib/doggo.ex), which returned date field values wrapped in the {:safe, ...} Phoenix.HTML marker without escaping them, causing unescaped user input to reach the value attribute of during form ...

CVE-2026-77017

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Zugewiesene CVE-ID: CVE-2026-66753 Zusammenfassung tinyhttp lehnt Wagenrücklauf oder Zeilenvorschub in HTTP-Header-Werten nicht ab, und zwar in keiner Richtung. Auf der Anforderungsseite beendet...

http-protocol-exfil

http-protocol-exfil Use the HTTP protocol version to send a file bit by bit "HTTP/1.0" is a 0 and "HTTP/1.1" is a 1. It uses GET requests so the Blue Team would only see the requests to your IP address. However, it takes a long time to send bigger files, for example it needs 1 hour to send 200 KB...

wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...

CVE-2025-4334

🔓 Simple User Registration = 6.3 - Escalata dei Privilegi Non Autenticata 📄 Descrizione Il plugin Simple User Registration per WordPress è vulnerabile all'Escalata dei Privilegi in tutte le versioni fino alla 6.3 inclusa. Ciò è dovuto a insufficienti restrizioni sui metadati utente che possono...

urlbuster

root@kitploit: ██╗ ██╗██████╗ ██╗ ██████╗ ██╗ ██╗███████╗████████╗███████╗██████╗ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║██╔════╝╚══██╔══╝██╔════╝██╔══██╗ ██║ ██║██████╔╝██║ ██████╔╝██║ ██║███████╗ ██║ █████╗ ██████╔╝ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║╚════██║ ██║ ██╔══╝ ██╔══██╗ ╚██████╔╝██║...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

python-pyasn1 security update

An update is available for python-pyasn1. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

Important: Red Hat Security Advisory: resource-agents security update

An update for resource-agents is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2023-50257

ROS2 CVE-2023-50257 Reproduktion 🔍 Übersicht Dieses Repository basiert auf einem PoC für CVE-2023-50257 und automatisiert die Erfassung von RTPS-Paketen, analysiert GUID-Werte und sendet ein erfolgreiches DoS-Paket. CVE-2023-50257 ist eine bekannte Sicherheitslücke in ROS2 Robot Operating System ...

DEBIAN-CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

Important: Red Hat Security Advisory: python-pyasn1 security update

An update for python-pyasn1 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...