CVE-2026-15887: Server-Side Request Forgery (SSRF)

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...

PT-2026-91451

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description Blind server-side request forgery occurs when processing SOAP requests. Server-side request forgery is a flaw that allows an attacker to indu...

Chamilo Command Injection

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11. up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. id: CVE-2023-34960 info: name: Chamilo Command Injection author: DhiyaneshDK severity: critical...

CVE-2026-79393

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...

CVE-2026-79393

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...

CVE-2026-79393

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...

PT-2026-90044

Name of the Vulnerable Software and Affected Versions Xiongmai IP Camera XM530 versions prior to HMT.CM2005-v220608.1837 Description A heap-based buffer overflow occurs in the WS-Addressing Action transformation function within the Sofia IPC daemon. Remote unauthenticated attackers can trigger th...

CVE-2026-79395

The Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier) is vulnerable to an improper authentication flaw in the Sofia IPC daemon . The vulnerability exists within the WS-Security (wsse:UsernameToken) verification routine, allowing remote attackers to bypass authentication by s...

CVE-2026-79393

The Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier) is vulnerable to a heap-based buffer overflow in the Sofia IPC daemon . The flaw exists within the WS-Addressing Action transformation function , where a crafted SOAP request containing a wsa5:Action string exceeding 128 ...

CVE-2026-79395: Improper Authentication

An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...

CVE-2026-47156

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

EUVD-2026-75087

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156

MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user holding a valid cookie_string (obtainable from the MANTIS_STRING_COOKIE browser cookie after login) can authenticate as any other user by supplying that cookie_stri...

CVE-2026-47156: Improper Authentication

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

SAP NetWeaver AS Java Denial of Service (3736494)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a denial of service vulnerability as referenced in SAP Security Note 3736494: - SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested...

Security Bulletin: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-16190 DESCRIPTION: IBM WebSphere Application Server is affected by an authorization bypass vulnerability. CWE:CWE-862: Missing Authorization CVSS...

CVE-2026-58234

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...