PT-2026-34250

🗓️ 22 Apr 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbu.gs👁 20 Views

Vulnerability in Spring Security allows timing bypass when UserDetails status checks are used.

Reporter	Title	Published	Views	Family All 608
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Input Validation in QOS.CH logback-core [CVE-2026-1225]	27 Feb 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the logback-core library that could allow denial-of-service through specially crafted inputs (CVE-2026-1225).	27 Mar 202600:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	12 Aug 202611:52	–	ibm
IBM Security Bulletins	Security Bulletin: A logback-core-1.5.18.jar vulnerability found by Scanner affects IBM Rational Functional Tester / DevOps Test UI	25 May 202616:49	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.	27 Apr 202607:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	6 Apr 202610:00	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Observable Timing Discrepancy (CVE-2026-22746)	15 Jun 202620:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in logback-core-1.3.14.jar affects IBM DevOps Code ClearCase [CVE-2024-12798, CVE-2024-12801, CVE-2025-11226,CVE-2026-1225]	10 Mar 202605:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	24 May 202615:12	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerability in logback-core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-1225)	28 Aug 202600:04	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42584
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-38827
osv	www.osv.dev/vulnerability/RHLW-2026-8fd370b9b3e9924a
osv	www.osv.dev/vulnerability/CVE-2026-50010
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42581
osv	www.osv.dev/vulnerability/CVE-2026-45416
github	www.github.com/advisories/GHSA-vxf7-qj7q-83fh
osv	www.osv.dev/vulnerability/GHSA-vxf7-qj7q-83fh
osv	www.osv.dev/vulnerability/ghsa-x4gw-5cx5-pgmh
osv	www.osv.dev/vulnerability/CVE-2023-2976

09 Oct 2026 00:00Current

6Medium risk

Vulners AI Score6

CVSS 3.13.7

CVSS 41.8

EPSS0.00215

SSVC

spring security timing attack user details is enabled account expired account locked vulnerability version impact