Security Bulletin: IBM Transformation Extender Advanced is affected by a IBM WebSphere Application Server Liberty vulnerability

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is vulnerable to IBM WebSphere Application Server Liberty's HTTP request smuggling vulnerability CVE-2026-11541 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes sectio...

Security Bulletin: IBM Transformation Extender Advanced is affected by IBM WebSphere Application Server Liberty vulnerabilities

Summary IBM WebSphere Application Server Liberty is used by IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine. Liberty has been updated to address CVE-2026-3621 which causes identity spoofing and CVE-2026-5516 which causes bypass security vulnerabilities...

CVE-2026-58245: Use of Hard-coded Credentials

SAP Advanced Planning and Optimization Model Mix Planning contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to...

CVE-2026-58115: Missing Authentication for Critical Function

A vulnerability has been identified in SIMATIC IoT2050 Advanced 6ES7647-0BA00-1YA2 All versions V4.3.4.1 running Industrial OS with Node-RED installed. Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are...

Siemens SIMATIC IoT2050 Advanced

SUMMARY SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server...

CVE-2026-68246 drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd...

EUVD-2026-55330

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses their indices to look up decode-dpb in cedruswritereflist. Rejecting...

EUVD-2026-55490

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5...

CVE-2026-19074

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-13701

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

CVE-2026-19074 Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-19074

The Advanced Classifieds & Directory Pro WordPress plugin (versions prior to 3.4.3 ) is vulnerable to unauthenticated sensitive information exposure. This issue occurs via the AJAX action acadp_public_custom_fields_listings, which allows unauthorized actors to disclose non-public listing custom f...

CVE-2026-19074 Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

EUVD-2026-54998

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-19074

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

EUVD-2026-55021

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

CVE-2026-13701 Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

CVE-2026-13701 Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

CVE-2026-13701

The Advanced Excerpt WordPress plugin (versions before 4.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly sanitize and escape one of its settings before outputting it on the website's front end. Specifically, the vulnerability is linked to the Ellipsis Setting ....

CVE-2026-13701

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...