Security Bulletin: IBM Event Processing is vulnerable to unauthorized access to hidden files and stored cross-site scripting (XSS) (CVE-2025-11965, CVE-2025-11966)

Summary IBM Event Processing is vulnerable to unauthorized access to hidden files and stored cross-site scripting XSS when using Eclipse Vert.x. Vulnerability Details CVEID:CVE-2025-11965 DESCRIPTION: In Eclipse Vert.x versions 4.0.0, 4.5.21 and 5.0.0, 5.0.4, a StaticHandler configuration for...

CVE-2026-26999

creationtimestamp| type| source ---|---|--- 2026-03-04 13:10:46+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-xw98-5q62-jx94 2026-03-05 14:20:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgcyldb6z52q 2026-03-05 19:18:58+00:00|...

GHSA-W7J5-J98M-W679

creationtimestamp| type| source ---|---|--- 2026-03-04 11:40:05+00:00| seen| https://gist.github.com/alon710/84656641e76e6cac1bcd394bf2b4a065...

Security Bulletin: IBM Event Streams is vulnerable to proxy bypass

Summary IBM Event Streams is vulnerable to proxy bypass due to improper handling of IPv6 zoneID CVE-2025-22870 Vulnerability Details CVEID:CVE-2025-22870 DESCRIPTION: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPRO...

Security Bulletin: IBM Event Streams is vulnerable to improper access control

Summary IBM Event Streams is vulnerable to improper access control leading to potential classloader access in Apache Commons BeanUtils CVE-2025-48734 Vulnerability Details CVEID:CVE-2025-48734 DESCRIPTION: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class w...

CVE-2026-29065

creationtimestamp| type| source ---|---|--- 2026-03-04 09:52:13+00:00| published-proof-of-concept| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9 2026-03-06 07:54:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgeti7qkgh2n...

CVE-2026-28773

creationtimestamp| type| source ---|---|--- 2026-03-04 08:23:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg7u6yydgj2o...

Security Bulletin: IBM Event Endpoint Management is vulnerable to unauthorized access

Summary IBM Event Endpoint Management is vulnerable to unauthorized access due to improper restriction of hidden directories CVE-2025-11965 Vulnerability Details CVEID:CVE-2025-11965 DESCRIPTION: In Eclipse Vert.x versions 4.0.0, 4.5.21 and 5.0.0, 5.0.4, a StaticHandler configuration for...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service

Summary IBM Event Streams is vulnerable to a denial of service due to inefficient handling of slow SSH key exchanges CVE-2025-22869 Vulnerability Details CVEID:CVE-2025-22869 DESCRIPTION: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients...

Security Bulletin: IBM Event Streams is vulnerable to unintended response header modification

Summary IBM Event Streams is vulnerable to unintended response header modification due to a flaw in the on-headers module CVE-2025-7339 Vulnerability Details CVEID:CVE-2025-7339 DESCRIPTION: on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service

Summary IBM Event Streams is vulnerable to a denial of service due to excessive regular expression complexity in brace‑expansion CVE-2025-5889 Vulnerability Details CVEID:CVE-2025-5889 DESCRIPTION: A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has be...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service

Summary IBM Event Streams is vulnerable to a denial of service due to non‑linear parsing of malicious input. CVE-2024-45338 Vulnerability Details CVEID:CVE-2024-45338 DESCRIPTION: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length...

CVE-2026-3076

creationtimestamp| type| source ---|---|--- 2026-03-04 00:12:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg6ypvbdzz2k...

Hono 注入漏洞

Hono is a web framework written in TypeScript for the Hono community. Versions of Hono prior to 4.12.4 had an injection vulnerability. This vulnerability stemmed from the streamSSE function not verifying carriage returns or line feeds in event, ID, and retry fields, which could lead to the...

PT-2026-23112

Name of the Vulnerable Software and Affected Versions Drupal Google Analytics GA4 versions prior to 1.1.14 Description The Google Analytics GA4 module does not properly sanitize custom attributes added to the script tag used to load the Google Analytics library, leading to a Cross-Site Scripting...

WordPress plugin My Calendar – Accessible Event Manager 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005525)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005525 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix handling of HCIEVIOCAPAREQUEST If we received HCIEVIOCAPAREQUEST while...

CVE-2026-27601

creationtimestamp| type| source ---|---|--- 2026-03-03 23:59:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg6xz656gz2z...

GHSA-2CH6-X3G4-7759

creationtimestamp| type| source ---|---|--- 2026-03-03 23:55:03+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mg6xrczbiv2t...

OpenClaw's Node role device-identity bypass allows unauthorized node.event injection

Summary A client authenticated with a shared gateway token could connect as role=node without device identity/pairing, then call node.event to trigger agent.request and voice.transcript flows. Affected Packages / Versions - Package: npm openclaw - Affected versions: = 2026.2.21-2 - Patched versio...