PT-2026-108032

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web fetch tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

PT-2026-107810

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during...

PT-2026-107801

A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP...

PT-2026-107777

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...

PT-2026-108055

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to web and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...

PT-2026-108047

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to web and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

PT-2026-107785

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

PT-2026-108015

🚨 CVE-2026-14999 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures...

Mobile-Drop-Device-SOC-Detection

🛡️ Project Phantom: Mobile "Drop Device" SOC Detection Simulation This project demonstrates an end-to-end SOC laboratory workshop simulating how an unauthorized, root-less Android device Casper Via S, used as a "Drop Device" within an internal network, is detected via Wazuh SIEM when launching...

ReconHound

ReconHound ReconHound is a Python-based web reconnaissance tool built for penetration testers, bug bounty hunters, and ethical hackers. It helps identify hidden paths, files, subdomains, query parameters, virtual hosts, and fuzzable endpoints — making it a versatile solution for deep web...

Securiscan

Securiscan Securiscan Securiscan is a robust, lightweight, and native standard-library security triage engine built to analyze vulnerabilities across Web Applications, APIs, LLMs, and Mobile Packages completely using Python standard built-ins. 🚀 Core Execution Modes 1. Passive External Inspection...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.11.2 release.

Red Hat Web Terminal Operator 1.11.2 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

CVE-2026-76276

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

EUVD-2026-94628

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

CVE-2026-76276

Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10 are vulnerable to an information disclosure flaw in the Discover Splunk Observability Cloud app via Splunk Web. A low-privileged user lacking "admin" or "power" roles can retrieve the app's original source code because production JavaSc...

CVE-2026-103371

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

EUVD-2026-94553

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

CVE-2026-103371

Apache Geode versions 2.0.0 through 2.0.3 are affected by a vulnerability where the Management REST API improperly inserts sensitive information into log files. This issue, identified as CWE-532 , could lead to the exposure of confidential data through system logs. To mitigate this risk, users ar...

CVE-2026-103371 Apache Geode: Management REST API: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

Security Bulletin:RabbitMQ Web STOMP WebSocket Handler Vulnerability: Unbounded Pre-Authentication State

Summary RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of sma...