CVE-2026-13258

IBM DataPower Gateway is vulnerable to a cross-site scripting (XSS) flaw (CWE-79) in its Web UI. This vulnerability allows an authenticated user to embed arbitrary JavaScript code, which can alter functionality and potentially lead to credentials disclosure within a trusted session. Affected vers...

CVE-2026-13258 IBM DataPower Gateway Cross-Site Scripting

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended...

EUVD-2026-94986

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2026-14990 IBM DataPower Gateway affected by cross-site scripting

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2026-14990

The IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 are vulnerable to a Cross-Site Scripting (XSS) vulnerability (CWE-79). This flaw allows an unauthenticated user to embed arbitrary JavaScript code into the Web UI, which can alter intended functionality and potentially lead to the disc...

CVE-2026-92555 Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26...

CVE-2026-107503

In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect OIDC provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. It adopt...

Exploit for CVE-2026-18963

CVE-2026-18963: Keycloak reset-credentials flow bypass Unauth...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler (versions 3.2.0 before 3.4.3 ) allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrators. The exposed kubeconfig data contains credentials that could permit unauthorized access to the Kubern...

EUVD-2026-94809

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

CVE-2026-71895 Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

CVE-2026-87428

In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches...

CVE-2026-85422

A vulnerability in Brocade ASCG version before 3.5.0 allows an attacker to obtain a static cryptographic key hardcoded into the software binaries. This key is used to secure sensitive data at rest and protect inter-node communication protocols. An attacker successfully extracting this key can dec...

EUVD-2026-94787

A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored managemen...

CVE-2026-92861

The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application...

CVE-2026-87672

An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support...

CVE-2026-87672

An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1 . When SupportLink is configured with an authenticated HTTP proxy, the system stores the full proxy URL in cleartext. Consequently, individuals with access...

CVE-2026-87672

An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support...

CVE-2026-87672

An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support...

EUVD-2026-94677

An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support...