A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
A phishing campaign uses over 300 fake domains impersonating mostly US financial institutions to target business banking and treasury logins. The phishing sites serve legitimate-looking login pages to first-time visitors but show fake 'account suspended' pages to returning visitors to evade takedown efforts. The campaign leverages Cloudflare to hide hosting details and uses IP tracking to differentiate visitors. This tactic complicates detection and takedown since security teams see only the fake suspended page on repeat visits. The campaign also targets victims in the UK, Australia, and New Zealand.
A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection.
This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1.
In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role.
The chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap `<keycloak.fullnameOverride>-realm`. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the `admin` role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment.
The bundled Keycloak is disabled by default. No fixed release of the `aas-basyx-v2-full` chart exists. Affected users should migrate to the `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows Path Traversal.
This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1.
A cyberattack targeted refrigeration systems at three French blood bank sites, attempting to raise storage temperatures to levels that could compromise plasma products. The attack was detected and mitigated in time, preventing any loss or health consequences. The incident is linked to a supplier of refrigeration equipment and follows similar attacks on supermarket refrigeration systems in Europe.
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
NoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the resolve option so that the client connects to the exact IP that was checked. The issue is that resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.
An attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the primary_ip in the on_progress callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.
A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.get_prompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claude_skill/__init__.py of the component Jinja2 Template Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is sufficient to fix this issue. The identifier of the patch is a9e7a3c026d114fcfb4ffe3eaf78851a636ded16. It is suggested to upgrade the affected component.
Cisco and WatchGuard have released patches addressing multiple vulnerabilities, including a high-severity remote code execution (RCE) flaw in Cisco UCS Central Software and critical authentication and integrity issues in WatchGuard products. WatchGuard also disclosed a critical use-after-free vulnerability in the Linux kernel affecting some of its products, though not exploitable via RCE in those cases. SonicWall's legacy Global Management System (GMS), which reached end-of-life in October 2025, contains two vulnerabilities—a critical unauthenticated file read and a medium-severity SQL injection—that will remain unpatched.
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Improper output neutralization for logs in Apache Sling Engine.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Apache Juneau versions through 9.2.0 have an Insufficiently Protected Credentials vulnerability in the RestClient component. The RestClient followed HTTP redirects while retaining credential headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key from the original request. This behavior could expose sensitive credentials to unintended hosts or downgrade from HTTPS to HTTP, risking credential leakage. The issue is fixed in version 9.2.1 by changing the handling of redirects and credential headers.
A weakness in eosphoros-ai DB-GPT up to version 0.8.2 affects the exec_module function in the hf_adapter.py file of the HuggingFace Adapter component. Manipulating the trust_remote_code argument can cause inclusion of functionality from an untrusted source. This vulnerability can be exploited remotely. Public exploit code is available. The project has been informed but has not yet responded or issued a fix.
CVE-2026-73117 is a critical vulnerability in Apache Juneau through version 9.2.0 involving improper neutralization of CRLF sequences in HTTP headers, also known as HTTP Response Splitting. The issue arises because the REST server passes response header values and redirect targets to the servlet container without sanitization. This can allow remote clients to inject header lines or redirect users to arbitrary external sites if the application sets headers or redirects based on request data. The vulnerability is fixed in version 9.2.1, which sanitizes header values by default and introduces a safer redirect method.
Apache Juneau versions through 9.2.0 have a vulnerability where sensitive request headers are logged in cleartext when a server error occurs. This includes headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key. The issue is fixed in version 9.2.1.
Apache Juneau versions through 9.2.0 have a cross-site scripting (XSS) vulnerability due to improper HTML encoding of variable substitutions in page chrome elements. This affects applications that include request-derived variables in the chrome, such as headers or form data, reflecting unencoded input and enabling XSS attacks. The default chrome does not use request variables, so only customized applications are impacted. The issue is fixed in version 9.2.1.
Apache Juneau versions through 9.2.0 have a vulnerability where error messages expose sensitive internal exception details to remote clients. This occurs because the REST server includes the internal exception class and message in a "Thrown" response header and may include exception messages in the error body, even when stack-trace rendering is disabled. This information disclosure reveals implementation details that could aid attackers. The issue is fixed in version 9.2.1.
Apache Juneau versions through 9.2.0 contain a vulnerability in the MessagePack parser used by the REST server. An unauthenticated client can trigger large buffer allocations from crafted input length values, causing an OutOfMemoryError and denial of service. Related unbounded allocations in multipart uploads and request reader buffers are also addressed in the fix. The issue is resolved in version 9.2.1.