CVE-2026-105623

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files...

CVE-2026-105623

The web interface in Zenitel Connect (versions before 1.11.0) is vulnerable to an information disclosure flaw because it serves production JavaScript source maps without authentication. A remote attacker can request these source map files to obtain the complete front-end source code, exposing API...

EUVD-2026-125457

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files...

CVE-2026-105623 Zenitel Connect web interface serves production JavaScript source maps without authentication

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files...

source-map-js: source-map-js: Denial of Service via malformed indexed source maps

A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it...

Security Bulletin: IBM Test Accelerator for Z uses source-map-js which is vulnerable to CVE-2026-93749

Summary IBM Test Accelerator for Z uses source-map-js which is vulnerable to CVE-2026-93749. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-93749 DESCRIPTION: source-map-js through 1.2.1 fails to validate the...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in source-map-js (CVE-2026-93749)

Summary IBM Db2 Developer Extension is affected by vulnerability in source-map-js CVE-2026-93749 Vulnerability Details CVEID:CVE-2026-93749 DESCRIPTION: source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary...

CVE-2026-75076

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files...

CVE-2026-75076

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 are vulnerable to an information disclosure flaw. The root cause is the exposure of JavaScript source map files , which could allow a remote attacker to obtain sensitive information. This vulnerability is associated with CWE-200 . Remedia...

CVE-2026-76276

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

CVE-2026-76276 Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

CVE-2026-76276

Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10 are vulnerable to an information disclosure flaw in the Discover Splunk Observability Cloud app via Splunk Web. A low-privileged user lacking "admin" or "power" roles can retrieve the app's original source code because production JavaSc...

EUVD-2026-94628

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

CVE-2026-76276 Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

PT-2026-107698

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A low-privileged user without admin or power roles can retrieve the original source code for the...

CVE-2026-76276: Initialization of a Resource with an Insecure Default

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

SUSE CVE-2026-93749

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

GHSA-68FV-2MGG-JV7Q source-map-js allows event-loop denial of service through indexed source-map section offsets

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

source-map-js allows event-loop denial of service through indexed source-map section offsets

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

CVE-2026-93749

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...