CVE-2026-12943

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments HMC and Novalink could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied...

CVE-2026-66755 Apache Tika: Arbitrary Local File Read in ISArchiveParser

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

EUVD-2026-51276

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

CVE-2026-67594

Summary (CVE-2026-67594): Spikster (commit e1cdf8c) contains a missing authentication flaw in the API route group due to the CipiAuth middleware being registered but never applied. This allows unauthenticated remote attackers to access approximately 50 API endpoints, enabling enumeration and prov...

EUVD-2026-51270

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-12943

CVE-2026-12943 affects IBM Power HMC and PowerVM Novalink components. IBM HMC v10.3.1050.0–10.3.1064.0 and v11.1.1110.0–11.1.1112.0 allow an unauthenticated user to execute arbitrary commands with elevated privileges due to improper validation of user input. CAMs indicate a CVSS v3.1 base score o...

EUVD-2026-51260

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments HMC and Novalink could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied...

CVE-2026-12943 This Power Hardware Management Console update is being released to address

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments HMC and Novalink could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied...

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

openjdk: Improve certification checking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...

openjdk: Enhance JPEG handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. ASAN reports a heap integrity violation...

EUVD-2026-51200

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

CVE-2026-12118

CVE-2026-12118 affects IBM webMethods Integration (on-prem) versions 10.15 and 10.11 due to deserialization of untrusted data in the bundled WmServiceMock package, allowing an unauthenticated remote attacker to execute arbitrary code. There is no product patch; remediation is to remove the WmServ...

CVE-2025-0152

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended...

EUVD-2025-210544

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended...

CVE-2025-0152 IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended...

CVE-2025-0152 IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended...

CVE-2025-0152

CVE-2025-0152 affects IBM Engineering Requirements Management DOORS and DOORS Web Access (versions 9.7.2.1–9.7.2.11 and 9.6.1.1–9.6.1.13). The issue is a cross-site scripting (XSS) vulnerability allowing an unauthenticated attacker to embed arbitrary JavaScript in the Web UI, potentially altering...