CVE-2026-48611-phpBB

CVE-2026-48611-phpBB 绕过身份验证 简单的绕过身份验证PoC，如果想通过浏览器访问，别忘了根据浏览器显示的User-Agent更改脚本中的 USERAGENT 变量，否则无法正常工作。使用Cookie编辑器替换 sid和 u的值。 影响版本：phpBB 3.3.16及以下 + 4.0.0-a2 phpbb python3 exploit.py https://localhost:8000 joushk + Target: https://localhost:8000 + Target username: joushk + User-Agent: Mozilla/5.0...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into t...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions a...

IAM for AI agents: A Practical Enterprise Framework

What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of conventional provisioning, the components that matter, how...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all core modules. This...

New Remote DoS Attacks Against GraphQL Java

Executive Summary Imperva Threat Research identified a series of remote denial‑of‑service vulnerabilities in GraphQL Java, one of the most widely used libraries for GraphQL in the Java ecosystem. In this blog, we’ll deep dive into these vulnerabilities, analyze their impact, and provide...

Heimdall

Heimdall He never sleeps, and sees a hundred leagues aroun...

OPENSUSE-SU-2026:21999-1 Security update for rclone

This update for rclone fixes the following issues: Changes in rclone: - Update to version 1.75.1: boo1279548 - Security - archive - Fix zip slip path traversal in untrusted zip files GHSA-66hp-wgxq-6f5q CVE-PENDING Nick Craig-Wood - Hide any archive entry which escapes the directory being listed...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcpconnrequest bsc1235944 bsc1269731. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync...

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

In this article 1. Observed operators and targeting 2. Malware packaging and distribution 3. NeedyMantis architecture and capabilities 4. Mitigation and protection guidance 5. Hunting queries 6. Indicators of compromise Microsoft Threat Intelligence has identified NeedyMantis, a modular...

Security Bulletin: Multiple Vulnerabilities in IBM On Call Manager Mobile Application

Summary Multiple vulnerabilities were addressed in IBM On Call Manager Android and iOS mobile applications version 1.2.0 Vulnerability Details CVEID:CVE-2025-71329 DESCRIPTION: image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in OS kernel in version 11.0.0.3 Vulnerability Details CVEID:CVE-2026-46116 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete KASAN...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in OS kernel in versions 10.6.0.11 and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-46086 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU reade...

Security Bulletin: Multiple security vulnerabilities have been identified in Python packages shipped with IBM Guardium Cryptography Manager (GCM)

Summary Multiple security vulnerabilities identified in Python packages shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-48775 DESCRIPTION: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)

Summary IBM DataPower Gateway has addressed CVE-2026-66010 in 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...

Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in the third party libraries shipped with IBM Guardium Cryptography Manager GCM have been addressed. Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions...

Security Bulletin: Threat Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Threat Intelligence App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in qs

Summary Multiple vulnerabilities were addressed in IBM DataPower Gateway versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-82417 DESCRIPTION: Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callab...

Security Bulletin: The Use Case Manager App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Use Case Manager App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify befo...

Security Bulletin: IBM DataPower Gateway affected by request smuggling due to form-data (CVE-2026-12143)

Summary IBM DataPower Gateway addressed CVE-2026-12143 in form-data in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to...