Nimbus Vestige

Nimbus Vestige NV A forensic reconstruction engine for cloud and identity incident response. Given fragmented cloud, SaaS, and identity telemetry — control-plane logs, sign-in events, token and consent activity — NV reconstructs how an intrusion most likely moved across accounts and services,...

Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests

The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans RATs...

Security Bulletin: Security Vulnerability in Nimbus Jose JWT Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-53864)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Nimbus Jose JWT Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: storm (UTSA-2026-093009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093009 advisory. A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially...

Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data.

Summary There are multiple vulnerabilities impacting IBM Watson Studio in Cloud Pak for Data. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-61729 DESCRIPTION: Within HostnameError.Error, when constructing an error string, there is ...

Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays

The Iranian state-backed hacking group tracked as Nimbus Manticore aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549 has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South Asia. The intrusions involve the use of a...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing - Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service

Summary Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. Following IBM® Engineering Lifecycle Management product is...

ROOT-APP-MAVEN-CVE-2023-52428 CVE-2023-52428 in io.root.com.nimbusds:nimbus-jose-jwt - Patched by Root

Root has patched CVE-2023-52428 in the io.root.com.nimbusds:nimbus-jose-jwt package for Root:Maven. Multiple fixed versions available...

bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47761 via tinymce (>=8.0.2, <=8.2.2)

tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47761 Source advisory: OSV:GHSA-VG35-5WQ7-3X7W...

bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47762 via tinymce (>=8.0.2, <=8.2.2)

tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47762 Source advisory: OSV:GHSA-V98H-VMPC-FPQV...

bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47759 via tinymce (>=8.0.2, <=8.2.2)

tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47759 Source advisory: OSV:GHSA-Q742-QVGC-GC2F...

CVE-2026-35337

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

CVE-2026-35565

Stored Cross-Site Scripting XSS via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via innerHTML in...

bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47759 via tinymce (>=8.0.2, <=8.2.2)

tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47759 Source advisory: SNYK:JS-TINYMCE-17056166...

bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47761 via tinymce (>=8.0.2, <=8.2.2)

tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47761 Source advisory: SNYK:JS-TINYMCE-17056137...

bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47762 via tinymce (>=8.0.2, <=8.2.2)

tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47762 Source advisory: SNYK:JS-TINYMCE-17056141...

Iran’s Nimbus Manticore Used Trojanized Zoom Installers Against US Firms

Iran’s Nimbus Manticore hackers used trojanized Zoom installers to deploy malware against US firms during a wider IRGC linked cyber campaign...

Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning

The Iranian state-sponsored threat actor known as Nimbus Manticore aka Screening Serpens and UNC1549 has been attributed to a fresh campaign using lures impersonating organizations in the aviation and software sectors across the U.S., Europe, and the Middle East following the joint U.S.-Israeli...

Security Bulletin: A nimbus-jose-jwt-9.37.3.jar vulnerability found by Scanner affects IBM Rational Functional Tester / DevOps Test UI

Summary There is a vulnerability in nimbus-jose-jwt-9.37.3.jar used by Rational Functional Tester RFT / DevOps Test UI Test UI. RFT/Test UI has addressed the applicable CVE Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before...

Improper Authentication

org.springframework.security:spring-security-oauth2-jose is vulnerable to Improper Authentication. The vulnerability is due to missing configuration of a JWT validator when using NimbusJwtDecoder or NimbusReactiveJwtDecoder, which allows an attacker to bypass token validation with crafted JWTs...