CVE-2026-114478 Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer

Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain...

CVE-2026-114478 Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer

Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Bouncy Castle for Java

Summary IBM SPSS Modeler is affected by vulnerabilities in Bouncy Castle for Java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-8384 DESCRIPTION: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the...

php2shell-exploit

CVE-2026-109618 / CVE-2026-109619 — PHP session.uploadprogre...

CVE-2026-102829

A flaw was found in simple-git. The software fails to include the VISUAL environment variable in its unsafe editor detection checks. If a consuming application accepts untrusted environment variables, an attacker can specify a malicious program that Git launches during interactive operations,...

CVE-2026-98629

A flaw was found in the Linux kernel's u32 traffic control classifier clsu32. A local user with network administration privileges can trigger this flaw by creating and removing filter hash tables with manually assigned handles. Due to an identifier mismatch between table creation and deletion...

CVE-2026-104949

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

EUVD-2026-107264

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

CVE-2026-104949

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

CVE-2026-104949

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

CVE-2026-104949

WarehousePG (WHPG) versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are susceptible to a missing authorization vulnerability (CWE-862 ) in the gp_add_coordinator_standby() function (known as gp_add_master_standby() in WHPG 6). The root cause is the lack of superuser privilege requirements f...

Vibe-Trading LLM-callable Tools Permit Command Execution, Code Injection, And SSRF

Summary: 5 findings — "BashTool" shell-injection sink F6, the canonical RCE primitive, "BackgroundRunTool" async shell-injection sink F7, backtest "execmodule" runs top-level statements before the "SignalEngine" class check F8 — independent RCE path that does not match BashTool signatures,...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed multiple vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th...

Security update for python-hpack

This update for python-hpack fixes the following issue: CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...

SUSE-SU-2026:4832-1 Security update for python-hpack

This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035...

php2shell-bypass-aslr-exp

php2shell – Official environment; no need for displayerrors,...

Exploit for CVE-2026-109618

php2shell-check Check, then apply, the php2shell fix on y...

BIT-NGINX-GATEWAY-2026-93479 NGINX map directive and regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

BIT-NGINX-2026-93479 NGINX map directive and regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...