Security Bulletin: IBM ApplinX is vulnerable to allocation of resources without limits or throttling vulnerability caused due to parsing oversized baggage.

Summary IBM ApplinX is vulnerable to allocation of resources without limits or throttling vulnerability caused due to parsing oversized baggage. IBM ApplinX has been updated in order to address the vulnerability CVE-2026-45292. Vulnerability Details CVEID:CVE-2026-45292 DESCRIPTION:...

CLEANSTART-2026-RZ47271 Security fixes in elasticsearch 9.4.4-r5

Package elasticsearch version 9.4.4-r5 fixes 2 vulnerabilities: CVE-2026-71497, CVE-2026-45292...

CVE-2026-45292

creationtimestamp| type| source ---|---|--- 2026-07-01 15:16:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplspxj3ro22 2026-08-25 12:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtvtwiw3pf26...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-server-admin (>=2.10.0, <=3.4.0) +625 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (>=1.0.0, <=1.61.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version =1.0.0, =2.10.0, =3.6.0, =1.1.0, =2.10.0, =2.10.0, =2.10.0, =3.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.4.0 - br.com.sawcunhaos:scos-foundation-security 1.1.0 - ch.admin.bit.jeap:jeap-archrepo-dbschem...

CVE-2026-45292

The opentelemetry-java Java implementation (specifically opentelemetry-api and opentelemetry-extension-trace-propagators ) is vulnerable to unbounded memory allocation and CPU consumption due to parsing oversized baggage prior to version 1.62.0 . Because baggage is automatically re-injected into ...

CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...

com.comcast.money:money-akka_2.12 (>=0.9.1-rc1, <=0.10.0), com.comcast.money:money-akka_2.13 (>=0.9.1-rc1, <=0.10.0) +65 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-api (0.10.0)

io.opentelemetry:opentelemetry-api MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-api and may be impacted: - com.comcast.money:money-akka2.12 =0.9.1-rc1, =0.9.1-rc1, =0.9.1-rc1, =0.9.1-rc1, =0.9.1-rc...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-server-admin (>=2.10.0, <=3.4.0) +625 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (>=1.0.0, <=1.61.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version =1.0.0, =2.10.0, =3.6.0, =1.1.0, =2.10.0, =2.10.0, =2.10.0, =3.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.4.0 - br.com.sawcunhaos:scos-foundation-security 1.1.0 - ch.admin.bit.jeap:jeap-archrepo-dbschem...

com.nepxion:discovery-plugin-strategy-starter-opentelemetry (6.6.0), com.nepxion:discovery-plugin-strategy-starter-sentinel-opentelemetry (6.6.0) +86 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-api (0.15.0)

io.opentelemetry:opentelemetry-api MAVEN version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-api and may be impacted: - com.nepxion:discovery-plugin-strategy-starter-opentelemetry 6.6.0 -...

au.com.titanclass:reactive-streams-telemetry_2.13 (>=2.0.0, <=2.1.0), com.appoptics.agent.java:appoptics-aws-lambda (>=1.0.0, <=1.0.1) +110 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-api (0.8.0)

io.opentelemetry:opentelemetry-api MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-api and may be impacted: - au.com.titanclass:reactive-streams-telemetry2.13 =2.0.0, =1.0.0,...

CVE-2024-45292

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...

CVE-2024-45292 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...

CVE-2024-45292 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...

CVE-2024-45292 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...

CVE-2024-45292

creationtimestamp| type| source ---|---|--- 2024-10-07 15:06:47+00:00| published-proof-of-concept| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh 2024-10-07 22:39:27+00:00| seen| https://t.me/cvedetector/7273 2025-03-08 04:35:51+00:00| seen|...

CVE-2023-45292

creationtimestamp| type| source ---|---|--- 2024-01-02 07:36:12+00:00| seen| https://t.me/ctinow/161539...

CVE-2023-50119

DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-45292. Reason: This record is a reservation duplicate of CVE-2023-45292. Notes: All CVE users should reference CVE-2023-45292 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

CVE-2023-50119

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-45292. Reason: This record is a reservation duplicate of CVE-2023-45292. Notes: All CVE users should reference CVE-2023-45292 instead of this record. All references and descriptions in this record have been removed to prevent...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-45292. Reason: This record is a reservation duplicate of CVE-2023-45292. Notes: All CVE users should reference CVE-2023-45292 instead of this record. All references and descriptions in this record have been removed to prevent...

CVE-2023-45292 Captcha verification bypass in github.com/mojocn/base64Captcha

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...