CVE-2025-6593

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0...

CVE-2025-36253

IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2025-6590

CVE-2025-6590 concerns MediaWiki. The vulnerability allows an unauthorized actor to disclose sensitive information via the program file includes/htmlform/fields/HTMLUserTextField.Php, affecting MediaWiki versions from any up to 1.39.12, 1.42.76, 1.43.1, and 1.44.0. The Red Hat description confirm...

CVE-2025-6594 XSS in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. This issue affects MediaWiki: from 1.27.0 before...

CVE-2025-6596 Vector inserts portlet labels as HTML, allowing for stored XSS through system messages

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vecto...

CVE-2025-36253 Multiple Vulnerabilities in IBM Concert Software.

IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

Security Bulletin: A SQL Injection vulnerability has been addressed in IBM Aspera Console

Summary A SQL Injection attack could allow specially crafted SQL statements into the appication which could impact the data in the back-end database. This issue has been addressed in IBM Aspera Console version 3.4.8 FP1. Vulnerability Details CVEID:CVE-2025-13379 DESCRIPTION: IBM Aspera Console i...

CVE-2026-1751

CVE-2026-1751 affects GitLab CE/EE versions starting with 16.8 up to before 18.5.0, enabling unauthorized edits to merge request approval rules under certain conditions. OSV sources corroborate the description, but no exploit details or active exploitation are provided in the supplied documents. ...

CVE-2026-1751

A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions...

CVE-2026-20711

Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords...

CVE-2026-22888

Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product...

CVE-2026-20711

CVE-2026-20711 describes a Cross-site scripting vulnerability in the E-mail function of Cybozu Garoon, affecting version range 5.0.0 through 6.0.3. The issue is triggered via the E-mail component and is reported to allow an attacker to reset arbitrary users’ passwords. The provided documents iden...

IBM WebSphere Application Server Liberty 路径遍历漏洞

IBM WebSphere Application Server Liberty is a Java application server developed by IBM, based on the Open Liberty project. Versions of IBM WebSphere Application Server Liberty from 17.0.0.3 to 26.0.0.1 have a path traversal vulnerability. This vulnerability arises when privileged users can upload...

PT-2026-5617

Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product...

PT-2026-5616

Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords...

CVE-2025-36366

IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) is affected by CVE-2025-36366. A local user could cause a denial of service by executing a query that invokes the JSON_Object scalar function, triggering an unhandled exception and abnormal server termination. The bulletin specifi...

@orval/angular (>=8.0.0-rc.0, <=8.1.0), @orval/axios (>=8.0.0-rc.0, <=8.1.0) +9 more potentially affected by CVE-2026-25141 via @orval/core (>=8.0.0, <=8.1.0)

@orval/core NPM version =8.0.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.6, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.1.0 Source cves: CVE-2026-25141 Source advisory: OSV:GHSA-GCH2-PHQH-FG9Q...

@orval/angular (>=7.19.0, <=7.20.0), @orval/axios (>=7.19.0, <=7.20.0) +8 more potentially affected by CVE-2026-25141 via @orval/core (>=7.19.0, <=7.20.0)

@orval/core NPM version =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.20.0 Source cves: CVE-2026-25141 Source advisory: OSV:GHSA-GCH2-PHQH-FG9Q...

fast-xml-parser has RangeError DoS Numeric Entities Bug

Summary A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points e.g., or . This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Details The...

GHSA-37QJ-FRW5-HHJH fast-xml-parser has RangeError DoS Numeric Entities Bug

Summary A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points e.g., or . This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Details The...