Security Bulletin: InfoSphere Data Replication - Data Replication for Availability is affected by arbitrary code execution, cross-site scripting, and denial of service

Summary IBM has released the below fix for IBM InfoSphere Data Replication - Data Replication for Availability Db2U Qreplication container in response to multiple vulnerabilities. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2026-33916...

Cross-site Scripting (XSS)

Overview @jupyterlab/apputils is a JupyterLab - Application Utilities Affected versions of this package are vulnerable to Cross-site Scripting XSS via the notebook paste action in packages/notebook/src/actions.tsx, which does not validate whether clipboard data originated from within the...

CVE-2026-102329

A cross-site scripting flaw was found in the WebUI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=563297615 https://code.google.com/p/chromium/issues/detail?id=102329...

DEBIAN-CVE-2026-102329

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...

CVE-2026-102329

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...

CVE-2026-102329

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...

CVE-2026-102329

A Cross-site scripting (XSS) vulnerability exists in the WebUI of Google Chrome prior to version 154.0.8037.92 . This flaw allows a remote attacker to bypass the web origin policy to access a privileged page by navigating the user to a crafted HTML page . No specific exploit code or in-the-wild e...

EUVD-2026-89395

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...

CVE-2026-102329

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...

CVE-2026-102831

A flaw was found in JupyterLab. This vulnerability allows Cross-Site Scripting XSS when pasting notebook cells from the system clipboard, as the application fails to clear trusted metadata flags from imported cell data. A remote attacker could exploit this by enticing a user to paste malicious ce...

CVE-2026-102830 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in DOMPurify (CVE-2026-41238, CVE-2026-41239, CVE-2026-41240)

Summary Multiple Cross-Site Scripting XSS vulnerabilities in DOMPurify CVE-2026-41238, CVE-2026-41239, CVE-2026-41240 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.4.12 on Windows and version 3.4.13 on Linux. Vulnerability Details...

CVE-2026-100238

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from before 1.46.1, 1.45.5, 1.43.10...

Security Bulletin: Multiple vulnerabilities within WebSphere Application Server, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within WebSphere Application Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-16184 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to...

Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the Data Insight DI component with a Service Pack update. Please understand that the new use of security bulletins represents a change in our communication process, not an increase in security...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.16 packages and security update

Red Hat OpenShift Container Platform release 4.22.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.22.16 security update

Red Hat build of MicroShift release 4.22.16 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.35 packages and security update

Red Hat OpenShift Container Platform release 4.21.35 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...