EUVD-2026-55864

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...

CVE-2026-44764

CVE-2026-44764 concerns SAP Manufacturing Integration and Intelligence (MII) where a missing authorization check in the Cost Servlet could allow an unauthenticated attacker to send crafted requests with specific parameters, potentially enabling read, create, modify, or delete operations on applic...

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

Zimbra Collaboration Suite - SSRF

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. id: CVE-2019-9621 info: name: Zimbra Collaboration Suite - SSRF author: riteshs4hu severity: high description: |...

ESAFENET CDG - Arbitrary File Download

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. id: CVE-2019-9632 info: name: ESAFENET CDG - Arbitrary File Download author: pdteam severity: hi...

CVE-2026-12605

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

EUVD-2026-53925

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a denial of service vulnerability (CVE-2026-15057)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a denial of service vulnerability due to an out-of-bounds write when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details Ref...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2026-14529)

Summary WebSphere Application Server is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-14529 DESCRIPTION: IBM...

Oracle Linux 8 : pki-deps:10.6 (ELSA-2026-43218)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-43218 advisory. - Resolves: CVE-2015-5262 - Resolves: CVE-2014-3577 - Resolves: rhbz1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-16531 Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-16531

CVE-2026-16531 affects PCP’s pmproxy logger servlet, where a crafted hostname enables path traversal leading to arbitrary file and directory creation and potential DoS. Root cause is unauthenticated remote exploitation of the logger servlet via crafted hostnames. The Red Hat mitigation recommends...

Linux Distros Unpatched Vulnerability : CVE-2026-16531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary...

CVE-2026-14529 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery SSRF when the SIP container feature sipServlet-1.1 is enabled...

PT-2026-65867

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery SSRF when the SIP container feature sipServlet-1.1 is enabled...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

SUSE-SU-2026:3112-1 Security update for tomcat10

This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve...