26 matches found
CLSA-2026-1785204448 TuxCare security update for org.springframework (5 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 5 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.1...
CLEANSTART-2026-OE12787 Security fixes in apache-superset 6.0.0-r5
Package apache-superset version 6.0.0-r5 fixes 18 vulnerabilities: ghsa-pwv6-vv43-88gr, ghsa-whj4-6x5x-4v2j, ghsa-cfh3-3jmp-rvhc, ghsa-5xmw-vc9v-4wf2, ghsa-wjx4-4jcj-g98j...
PT-2026-59202
Impact When relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the...
Security Bulletin: Vulnerability in pip affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in pip has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a runtime panic condition in go-git [CVE-2026-33762]
Summary IBM Watson Speech Services Cartridge is vulnerable to a runtime panic condition in go-git, due to a flaw in the index decoder for format version 4 that fails to validate the path name prefix length before applying it to the previously decoded path name CVE-2026-33762. Go-git is used as pa...
CVE-2026-33769 Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for / wildcards is unanchored, so a pathname that...
CVE-2025-65113
ClipBucket v5 contains an authorization bypass in the AJAX flagging system that allows any unauthenticated user to flag content (users, videos, photos, collections). Affected versions are prior to 5.5.2; this issue can enable mass flagging and moderation abuse. The vulnerability has been patched ...
CVE-2025-65236
OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint...
EUVD-2025-199722
A reflected cross-site scripted XSS vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload...
CVE-2025-65236
OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint...
CVE-2025-65237
A reflected cross-site scripted XSS vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload...
CVE-2025-65236
OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint...
CVE-2025-65237
A reflected cross-site scripted XSS vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload...
CVE-2025-65235
OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function...
CVE-2025-65237
A reflected cross-site scripted (XSS) vulnerability exists in OpenCode Systems USSD Gateway OC Release: 5 . This flaw allows an attacker to execute arbitrary JavaScript within a user's browser by injecting a crafted payload . The vulnerability is associated with CWE-79 (Improper Neutralization of...
PT-2025-48158
Name of the Vulnerable Software and Affected Versions OpenCode Systems USSD Gateway version 5 Description The OpenCode Systems USSD Gateway contains a SQL injection flaw. This issue is located in the /occontrolpanel/index.php API endpoint through the Session ID parameter. Successful exploitation...
CVE-2025-65236
The OpenCode Systems USSD Gateway OC Release: 5 is susceptible to a SQL injection vulnerability. The flaw exists in the /occontrolpanel/index.php endpoint due to improper neutralization of special elements in the Session ID parameter. Successful exploitation allows an attacker to manipulate datab...
CVE-2025-65236
OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint...
PT-2025-48159
A reflected cross-site scripted XSS vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload...