A flaw was found in ansible-core. When installing a collection with
`ansible-galaxy collection install`, the archive extractor validates member
paths using lexical path normalisation (os.path.abspath) instead of resolving
symbolic links (os.path.realpath), and it performs no containment check on
symlink-typed directory members before creating them. A crafted collection
tarball can chain symlink directory entries so that a subsequent file member is
written outside the intended destination directory. This allows an attacker who
can get a victim to install a malicious collection to overwrite arbitrary files
with the privileges of the user running ansible-galaxy, leading to code
execution on the control node. This is a bypass of the fix for CVE-2020-10691.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf comparisons always pass, allowing expired or not-yet-active tokens to be accepted. The verifier cache also derives infinite bounds, so entries created under this configuration can remain valid until eviction. Exploitation requires an application administrator or equivalent configuration path to set clockTolerance to Infinity. This issue is fixed in version 6.3.0.
svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> elements so the graph omits those references, after which the sanitizer converts the attribute to canonical xlink:href and returns the live nesting structure without applying the useNestingLimit protection. A consuming application that renders the sanitized SVG can therefore be exposed to the resource exhaustion that control is designed to prevent. This issue is fixed in version 1.0.0.
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is false, and the empty signature avoids the verifySignature gate. An attacker can therefore submit a token containing arbitrary claims without possessing a signing key, resulting in authentication or authorization bypass. Claim validators still run, and non-empty keys, an empty key without algorithms, and the async key resolver path do not have this behavior. This issue is fixed in version 6.3.1.
The FBI disrupted Chinese state-sponsored hacking operations by seizing seven domains used by the Flax Typhoon group and its contractor, Integrity Technology Group. The seized infrastructure supported two hacking tools, MicroScan and FishHub, which were used to scan for vulnerabilities, breach critical infrastructure, and conduct spear-phishing attacks globally. The tools targeted organizations including power companies, airports, universities, and government agencies across multiple countries. The FBI and international partners issued a joint advisory detailing the attackers' methods, targeted vulnerabilities, and indicators of compromise. The disruption aims to hinder China-linked cyber operations against U.S. and allied networks.
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadline only when iat is present, so the cache falls back to cacheTTL, and a later cache hit returns the saved payload before verifyToken rechecks expiration. An attacker who can replay the same cached bearer token can extend access until the cache entry expires, but cannot forge a token through this issue. This issue is fixed in version 6.3.4.
A URL redirection vulnerability (CWE-601) exists in AdonisJS HTTP Server versions prior to 8.2.3 and between 9.0.0 and before 9.3.0. The issue arises because route parameter values are inserted into URLs without proper encoding, allowing attacker-controlled input to create scheme-relative external URLs. This can enable attackers to redirect users to malicious sites, potentially facilitating phishing or abuse of authentication flows. The vulnerability is fixed in versions 8.2.3 and 9.3.0.
CVE-2026-107717 is an improper input validation vulnerability in masci banks prior to version 2.5.0. The Banks Prompt.chat_messages() function parses each line of rendered template output as ChatMessage JSON. If untrusted data is rendered and passed to an LLM provider, attacker-controlled JSON can manipulate the ChatMessage.role field, allowing an attacker to override application instructions or alter prompt structure. This issue is fixed in version 2.5.0.
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
CVE-2026-75875 is a critical path traversal vulnerability in IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. This flaw allows a remote attacker to execute arbitrary code by improperly limiting pathname access to restricted directories.
CVE-2026-80381 is a critical SQL injection vulnerability in IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. This flaw allows a remote attacker to execute unauthorized SQL commands without any privileges or user interaction, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-82895 is a high-severity buffer overflow vulnerability in IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. It allows a remote attacker to execute arbitrary code due to improper handling of input size during buffer copy operations.
IBM Guardium Data Protection versions 12.1 and 12.2.2 contain a path traversal vulnerability (CWE-22) that could allow a remote attacker to delete arbitrary files. This vulnerability arises from improper limitation of pathnames to restricted directories, potentially enabling unauthorized file deletion. The vulnerability has a high severity with a CVSS score of 8.1.
Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploitation could allow script execution in another user's browser when the affected content is viewed.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a SQL injection vulnerability that allows a remote unauthenticated attacker to send specially crafted SQL statements. This could enable the attacker to view, add, modify, or delete data in the back-end database. The vulnerability has a high severity score of 8.6 and affects these specific versions.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a stack-based buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code. The vulnerability has a high severity with a CVSS score of 8.1. No patch or remediation information is currently provided. There are no known exploits in the wild at this time.
IBM Guardium Data Protection versions 12.2.2 and 12.1 contain an OS command injection vulnerability (CWE-78) that could allow a remote attacker to execute arbitrary commands. The vulnerability arises from improper neutralization of special elements used in OS commands. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a buffer overrun vulnerability in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. This flaw allows a remote attacker to send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector, potentially causing denial of service or arbitrary code execution on the Collector appliance. The vulnerability is identified as CWE-119 and has a CVSS 3.1 score of 8.1, indicating high severity.