Sign In Create account

Security Advisories and Release Notes

CVE-2026-91403 - Oracle Java SE / GraalVM JSSE Vulnerability
2026-10-23

On 21 October 2026, Oracle released an out-of-cycle Security Alert for CVE-2026-91403, a critical vulnerability affecting the JSSE (Java Secure Socket Extension) component of Oracle Java SE and Oracle GraalVM for JDK. Oracle rates it CVSS v3.1 9.1 and states it is remotely exploitable over the network without authentication and without any user interaction.

PHP2Shell leak information
2026-10-21

On 20 October 2026, information leaked about two critical vulnerabilities in the PHP core, publicly called “PHP2Shell”. Public reporting describes them as remote code execution flaws that may be exploitable without authentication. Some hypotheses about the attack vector are circulating publicly, none of them has been confirmed by the PHP project.

CVE-2026-87902 – WordPress Core Remote File Inclusion Vulnerability
2026-10-01

A vulnerability has been found on Wordpress. With relevant pre-conditions for both the server and the active theme, this can lead to RCE. The ICX natively blocks the path traversal and file inclusion involved.

UBIKA WAAP Gateway/Cloud v2025.4/6.16.4
2026-09-03

New version 2025.4 / 6.16.4 is available ! (Bug fix / ICX engine parses GraphQL attributes).

CVE-2026-18963
2026-08-26

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak.

wp2shell
2026-07-22

WordPress is affected by a REST API batch endpoint route confusion issue (CVE-2026-63030) which, combined a specific SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

UBIKA WAAP Gateway & Cloud Security update 3.50.0
2026-07-17

A new security update for ICX patterns and rules is available!

Openssl cves : cve-2026-7383, 34182 and 45447
2026-06-18

Some vulnerabilities have been found on openssl : A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow; Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises; A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

CVE-2026-49975 - HTTP/2 Bomb
2026-06-05

A remote denial-of-service exploit against most major web servers, including: nginx, Apache httpd, Microsoft IIS, Envoy, Cloudflare Pingor has been published. The vulnerable behavior exists in each server’s default HTTP/2 configuration.

CVE-2026-9082 - Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
2026-05-20

A highly critical SQL injection vulnerability has been discovered in Drupal core's database abstraction API.

Linux Dirty Frag - CVE-2026-43284 and CVE-2026-43500
2026-05-12

Multiple vulnerabilities have been identified in certain Linux kernel components that could allow a local user to exploit improper memory handling, potentially leading to system corruption and privilege escalation.

Advisory for CVEs in Apache HTTP Server – Multiple Vulnerabilities (2.4.66)
2026-05-07

Multiple security vulnerabilities have been discovered in Apache HTTP Server, affecting versions through 2.4.66.

CVE-2026-23918
2026-05-06

A double-free vulnerability with potential for Remote Code Execution (RCE) has been discovered in Apache HTTP Server's HTTP/2 implementation. This issue affects Apache HTTP Server 2.4.66.

CVE-2026-24072
2026-05-06

An escalation of privilege vulnerability in various modules in Apache HTTP Server 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

CVE-2026-31431 Copy Fail
2026-05-05

A local privilege escalation vulnerability that exploits a logic flaw in the kernel cryptographic API (AF_ALG), affecting most Linux distributions.

UBIKA WAAP Gateway & Cloud Security update 3.50.0
2026-04-07

A new security update for ICX patterns and rules is available!

UBIKA WAAP Gateway/Cloud 6.11.15 (LTS)
2026-03-12

6.11.15 LTS version is out! (bug fixes and security components upgrade).

CVE-2026-21962
2026-01-22

A vulnerability has been found in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware.AVulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware.

CVE-2025-55182 React2Shell
2025-12-05

A critical pre-authentication remote code execution vulnerability, CVE-2025-55182 (CVSS3.x: 10), has been identified in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 .

UBIKA WAAP Gateway & Cloud Security update 3.49.0
2025-11-06

A new security update for ICX patterns and rules is available!

CVE-2025-47812 – Remote Code Execution in Wing FTP Server via Session File Injection
2025-08-22

Critical vulnerability impacting Wing FTP Server

Advisory CVE-2025-53770 - Unauthenticated Remote Code Execution in Microsoft SharePoint
2025-07-21

Critical vulnerability impacting SharePoint Server Subscription Edition, SharePoint Server 2016 et SharePoint Server 2019

UBIKA WAAP Gateway & Cloud Security update 3.48.0
2025-07-04

A new security update for ICX patterns and rules is available!

UBIKA WAAP Gateway & Cloud Security update 3.47.0
2024-09-27

A new security update for ICX patterns and rules is available!

UBIKA WAAP Gateway/Cloud 6.15.0 (Latest)
2024-09-05

6.15.0 version is out! (New Bot Mitigation workflow node, new 'busy workers' metric...).

Apache httpd 2.4.62 CVE related
2024-07-23

Statements on vulnerabilities fixed in new apache httpd version.

CVE-2024-6387 - OpenSSH race condition - RegreSSHion
2024-07-08

Critical vulnerability impacting OpenSSH.

Security Advisories and Release Notes

CVE-2026-91403 - Oracle Java SE / GraalVM JSSE Vulnerability2026-10-23

PHP2Shell leak information2026-10-21

CVE-2026-87902 – WordPress Core Remote File Inclusion Vulnerability2026-10-01

UBIKA WAAP Gateway/Cloud v2025.4/6.16.42026-09-03

CVE-2026-189632026-08-26

wp2shell2026-07-22

UBIKA WAAP Gateway & Cloud Security update 3.50.02026-07-17

Openssl cves : cve-2026-7383, 34182 and 454472026-06-18

CVE-2026-49975 - HTTP/2 Bomb2026-06-05

CVE-2026-9082 - Drupal core - Highly critical - SQL injection - SA-CORE-2026-0042026-05-20

Linux Dirty Frag - CVE-2026-43284 and CVE-2026-435002026-05-12

Advisory for CVEs in Apache HTTP Server – Multiple Vulnerabilities (2.4.66)2026-05-07

CVE-2026-239182026-05-06

CVE-2026-240722026-05-06

CVE-2026-31431 Copy Fail2026-05-05

UBIKA WAAP Gateway & Cloud Security update 3.50.02026-04-07

UBIKA WAAP Gateway/Cloud 6.11.15 (LTS)2026-03-12

CVE-2026-219622026-01-22

CVE-2025-55182 React2Shell2025-12-05

UBIKA WAAP Gateway & Cloud Security update 3.49.02025-11-06

CVE-2025-47812 – Remote Code Execution in Wing FTP Server via Session File Injection2025-08-22

Advisory CVE-2025-53770 - Unauthenticated Remote Code Execution in Microsoft SharePoint2025-07-21

UBIKA WAAP Gateway & Cloud Security update 3.48.02025-07-04

UBIKA WAAP Gateway & Cloud Security update 3.47.02024-09-27

UBIKA WAAP Gateway/Cloud 6.15.0 (Latest)2024-09-05

Apache httpd 2.4.62 CVE related2024-07-23

CVE-2024-6387 - OpenSSH race condition - RegreSSHion2024-07-08

CVE-2026-91403 - Oracle Java SE / GraalVM JSSE Vulnerability
2026-10-23

PHP2Shell leak information
2026-10-21

CVE-2026-87902 – WordPress Core Remote File Inclusion Vulnerability
2026-10-01

UBIKA WAAP Gateway/Cloud v2025.4/6.16.4
2026-09-03

CVE-2026-18963
2026-08-26

wp2shell
2026-07-22

UBIKA WAAP Gateway & Cloud Security update 3.50.0
2026-07-17

Openssl cves : cve-2026-7383, 34182 and 45447
2026-06-18

CVE-2026-49975 - HTTP/2 Bomb
2026-06-05

CVE-2026-9082 - Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
2026-05-20

Linux Dirty Frag - CVE-2026-43284 and CVE-2026-43500
2026-05-12

Advisory for CVEs in Apache HTTP Server – Multiple Vulnerabilities (2.4.66)
2026-05-07

CVE-2026-23918
2026-05-06

CVE-2026-24072
2026-05-06

CVE-2026-31431 Copy Fail
2026-05-05

UBIKA WAAP Gateway & Cloud Security update 3.50.0
2026-04-07

UBIKA WAAP Gateway/Cloud 6.11.15 (LTS)
2026-03-12

CVE-2026-21962
2026-01-22

CVE-2025-55182 React2Shell
2025-12-05

UBIKA WAAP Gateway & Cloud Security update 3.49.0
2025-11-06

CVE-2025-47812 – Remote Code Execution in Wing FTP Server via Session File Injection
2025-08-22

Advisory CVE-2025-53770 - Unauthenticated Remote Code Execution in Microsoft SharePoint
2025-07-21

UBIKA WAAP Gateway & Cloud Security update 3.48.0
2025-07-04

UBIKA WAAP Gateway & Cloud Security update 3.47.0
2024-09-27

UBIKA WAAP Gateway/Cloud 6.15.0 (Latest)
2024-09-05

Apache httpd 2.4.62 CVE related
2024-07-23

CVE-2024-6387 - OpenSSH race condition - RegreSSHion
2024-07-08