Security Bulletin: Multiple vulnerabilities in IBM SDK, Java technology affect IBM Tivoli Composite Application Manager for Transactions (Response Time)

Summary IBM SDK, Java Technology Edition is used by IBM Tivoli Composite Application Manager for Transactions Response Time. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performe...

CVE-2026-80524

A flaw was found in the Linux kernel's OP-TEE Open Portable Trusted Execution Environment Fast Fault-tolerant Architecture FFA component. A local attacker could exploit a missing null check when allocating protected memory. Under specific memory pressure conditions, this could lead to a null...

CVE-2026-47880

CVE-2026-47880 affects Spring Integration (5.5.21 and earlier, 6.4.0–6.4.12, 6.5.0–6.5.10, 7.0.0–7.0.5, and 7.1.0). The root cause is that DefaultJmsHeaderMapper copies all JMS user properties into Spring Integration MessageHeaders without excluding framework-significant names. A JMS producer can...

CVE-2026-47880 DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or jsonTypeId which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration...

CVE-2026-47880 DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or jsonTypeId which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration...

EUVD-2026-66843

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or jsonTypeId which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration...

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution

Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a...

D-Link Network Attached Storage - Backdoor Account

A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nassharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user...

OSIB

OWASP Open Security Information Base OSIB Página do Projeto: https://owasp.org/www-project-open-security-information-base Repositório de Software: https://github.com/OWASP/OSIB Ferramentas Fornecidas: mkdocsmacroosib.py módulo Python instalável manualmente osibmacro.py macro para copiar que impor...

CVE-2025-43541

CVE-2025-43541 ATTENZIONE: CODICE POTENZIALMENTE PERICOLOSO Questo repository contiene un Proof of Concept PoC in JavaScript/HTML relativo a una potenziale vulnerabilità in WebKit/JavaScriptCore identificata come CVE-2025-43541. Dichiarazione di responsabilità Questo codice potrebbe essere...

CVE-2026-7482

🚨 CVE-2026-7482: Heap Buffer Over-Read in Ollama 📝 Descrizione Il CVE-2026-7482 identifica una vulnerabilità critica di lettura fuori dai limiti nell'heap Heap Buffer Over-Read negli endpoint /api/create e /api/push di Ollama , un framework open source per eseguire modelli linguistici locali...

pwn2own2018

Pwn2Own 2018: Safari + macOS RCE no Safari, escape da sandbox e LPE para o kernel no macOS 10.13.3. Uso Instale o nasm e o tornado: root@kitploit: brew install nasm pip3 install tornado Verifique o config.py se quiser alterar o host ou as portas. Em seguida, inicie o servidor com ./server.py e...

jetty_9.4.31_CVE-2023-26048

Eclipse Jetty कैननिकल रिपॉज़िटरी यह Jetty प्रोजेक्ट के लिए कैननिकल रिपॉज़िटरी है, बेझिझक फ़ोर्क करें और अभी योगदान दें! पैच या पुल रिक्वेस्ट सबमिट कर रहे हैं? सुनिश्चित करें कि आपके पास Eclipse योगदानकर्ता समझौता ECA दर्ज है। eclipse.org/legal/ecafaq प्रोजेक्ट विवरण Jetty एक हल्का, अत्यधिक स्केले...

e-cology

Remote-Codeausführung in der Beanshell-Komponente von Fanwei e-cology OA Windows Linux Hinweis root@kitploit: 检测目标系统os.name（因为目标系统是windows的话，执行set等命令，需要手动敲cmd.exe /c set） 使用Unicode绕过exec过滤，部分站点 Payload root@kitploit: bsh.script=exec'whoami'; unicode bypass...

EUVD-2026-66829

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

AppEnumGuard

AppEnumGuard AppEnumGuard is a defensive tweak for the installed-application enumeration side channel tracked as CVE-2025-31207. It supports conventional rootless and rootHide jailbreak environments on iOS 15.0–18.4.1. The repository also contains a normal sandboxed iOS test application that...

Mi8E5-Unlocker-by-CVE-2026-43499

Kit di sblocco Mi 8e5 Assistente automatico per lo sblocco del bootloader dei dispositivi della serie Mi 8e5, che implementa CVE-2026-43499. Questo è un fork della release originale solo Windows di @Kernix, tradotto in inglese e portato su macOS/Linux. Repository originale:...

CVE-2026-20643

CVE-2026-20643 Pagina di test per CVE-2026-20643 diff: https://github.com/WebKit/WebKit/commit/850ce3163e55ebaa33f712d05681e5522b518806 https://www.flvin.com/blogs/2026/03/20/CVE-2026-20643/...

Exploit for Improper Access Control in Oracle Http_Server

CVE-2026-21962 — Oracle HTTP Server / WebLogic Server Proxy Pl...

Apkx-Hunter

APKX-Hunter v2.7.2 — Debian Package APKX-Hunter is an open-source Android Static Analysis Framework written entirely in C , purpose-built for Android security assessments, reverse engineering, malware analysis, OWASP MASVS compliance scanning, bug bounty hunting, and penetration testing. The...