Security Bulletin: IBM Application Modernization Accelerator is vulnerable to multiple vulnerabilities found in Java and Node.js

Summary There are multiple vulnerabilities in Java and Node.js used by IBM Application Modernization Accelerator CVE-2025-26791, CVE-2025-1470, CVE-2025-1471. Vulnerability Details CVEID:CVE-2025-26791 DESCRIPTION: DOMPurify before 3.2.4 has an incorrect template literal regular expression,...

GHSA-4W4V-5HC9-XRR2 vulnerabilities

Vulnerabilities for packages: solr...

GHSA-M9GF-397R-HWPG vulnerabilities

Vulnerabilities for packages: solr...

Mattermost allows members with permission to convert public channels to private and convert private to public

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public...

Privilege Escalation

camaleoncms is vulnerable to Privilege Escalation. The vulnerability is due to the use of the dangerous permit! method through mass assignment, which allows all parameters to pass through without filtering...

CVE-2024-54551

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing web content may lead to a denial-of-service...

PT-2025-20363

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified, related to the handling of dirty swapcache pages. When a dirty swapcache page is isolated by the reclaim process and the page isn...

OPENSUSE-SU-2025:14918-1 warewulf4-4.6.0-2.1 on GA media

These are all security issues fixed in the warewulf4-4.6.0-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14917-1 nodejs-electron-33.4.6-1.1 on GA media

These are all security issues fixed in the nodejs-electron-33.4.6-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-30348

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string with relocation of later data...

CVE-2025-29923

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there...

CVE-2025-29923 go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there...

CVE-2025-29923 go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there...

CVE-2025-29923

CVE-2025-29923 affects the Go Redis client library (go-redis). Prior to versions 9.5.5, 9.6.3, and 9.7.3, the client may return out-of-order responses when a timeout occurs during the CLIENT SETINFO phase at connection establishment, especially if identity transmission is enabled or timeouts are ...

GHSA-4JWC-W2HC-78QV vulnerabilities

Vulnerabilities for packages: parseable, wash, atuin, wadm, buck2, qdrant...

CVE-2019-13029

Multiple stored Cross-site scripting XSS issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser...

CVE-2025-22228

A flaw was found in the spring-security-core password encoder. This vulnerability allows incorrect password matching via input manipulation. Mitigation Red Hat Product Security does not have a recommended mitigation at this time...

Expected Behavior Violation

Overview sagemaker is an Open source library for training and deploying models on Amazon SageMaker. Affected versions of this package are vulnerable to Expected Behavior Violation via to the utilities.py component. An attacker can cause integrity problems within the pipeline, potentially leading ...

Aim Excessive Data Query Operations in a Large Data Table vulnerability

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of Text objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these...

Flask-CORS allows for inconsistent CORS matching

A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquoteplus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path...