Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION:...

CVE-2026-63030

CVE-2026-63030 WordPress REST API batch route confusion + SQL injection leading to unauthorized admin creation → Remote Code Execution RCE complete exploit chain PoC. For authorized security testing, vulnerability reproduction, and research only. Do not use against unauthorized targets...

Improper Validation of Specified Quantity in Input

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via loadaudiopyav in the audio transcription endpoint /v1/audio/transcriptions. The function...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

Stone Wu Path Traversal Vulnerability

Stone Wu’s Rongguang versions 1.2.0 and earlier have a path traversal vulnerability. This vulnerability stems from the subDir parameter in the POST /api/storage/upload request, which allows for path traversal. The LocalStorageStrategy.storeBytes function does not normalize the sequence of parent...

Siemens SIMATIC Drive Controller CPU 1504D TF: Code injection vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a code injection vulnerability. This vulnerability stems from an improper limitation of the executable content contained in the imported trace files. It may allow attackers to induce authorized users with access to the “Read diagnostics”...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the failure to properly validate and clean up the visual marker data in the imported CSV tracking files. This could allow attackers to induce authorized users with the “Read...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability arises from the improper validation and cleanup of the visual properties of signals before they are calculated in the imported CSV tracking files rendered on the Trace page. This allows...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the improper cleaning of signal data calculated from imported CSV trace files. It may allow attackers to induce users with permission for the “Read diagnostics” function to...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the improper cleaning of annotation fields in the trace files rendered on the Trace page. As a result, attackers can induce authorized users with the “Read diagnostics” functi...

Sergio Brighenti XBackBone authorization issue vulnerability

Sergio Brighenti’s XBackBone 3.8.2 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization verification. Certified users can use the POST /upload/id/vanity route to change other users’ upload sharing codes. An attacker could provide consecutive uplo...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components

Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-23216 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in...

CVE-2026-108812

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CVE-2026-108812 SEMCMS SEMCMS_User.php user improper authorization

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CVE-2026-108812

A security vulnerability exists in SEMCMS versions up to 5.0 due to improper authorization within an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. This flaw allows for remote manipulation, potentially leading to unauthorized actions. The vendor has not responded to re...

CVE-2026-108812 SEMCMS SEMCMS_User.php user improper authorization

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

EUVD-2026-97285

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CrushFTP VFS - Sandbox Escape LFR

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox. id: CVE-2024-4040 info: name: CrushFTP VFS - Sandbox Escape LFR author: DhiyaneshDK,pussycat0x severity:...

CVE-2026-109342: Missing Authentication for Critical Function

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with...