EUVD-2026-33737

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security...

CVE-2026-9319 IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security...

CVE-2026-9319

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in jackson-core-2.14.2.jar

Summary IBM Watson Discovery Cartridge affected by vulnerability in jackson-core-2.14.2.jar Vulnerability Details ID:WS-2026-0003 DESCRIPTION: The non-blocking async JSON parser in jackson-core bypasses the maxNumberLength constraint default: 1000 characters defined in StreamReadConstraints. This...

CVE-2026-9319: Deserialization of Untrusted Data

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security...

WS-2022-0136

The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities eg. workspace title or media title. This however means you must be a logged in user with respective rights in the first place to...

WS-2022-0125

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of...

02moduletest (1.0.0), 10er10 (0.23.0) +5141 more potentially affected by unknown CVE via ws (>=0.3.1, <=1.1.1)

ws NPM version =0.3.1, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.9.0, =0.0.1, =0.0.1, =0.1.2, =1.0.1, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.1.16-master.20181116180810, =0.1.59-master.20200611224542 and more Source cves: unknown CVE Source advisory:...

WS-2017-0420

Affected version of ws 3.3.0 and before, are vulnerable to a specially crafted value could be used to make a ws server crash...

Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI

Summary Multiple vulnerabilities were addressed in IBM Tivoli Netcool/OMNIbusGUI 8.1.0 Fix Pack 41. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible i...

org.apache.cxf.systests:cxf-systests-jaxrs (2.3.4), org.apache.cxf.systests:cxf-systests-transports (2.3.4) +4 more potentially affected by CVE-2026-44417 via org.apache.cxf:cxf-rt-transports-jms (2.3.4)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.3.4 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.3.10), org.apache.cxf.systests:cxf-systests-transports (2.3.10) +4 more potentially affected by CVE-2026-44417 via org.apache.cxf:cxf-rt-transports-jms (2.3.10)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.3.10 -...

org.apache.cxf:apache-cxf (4.2.0), org.apache.cxf:cxf-distribution-javadoc (4.2.0) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (4.2.0)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-ws-transfer and may be impacted: - org.apache.cxf:apache-cxf 4.2.0 - org.apache.cxf:cxf-distribution-javadoc 4.2.0 Source cves:...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: GHSA-VMM5-FJGX-2JHP...

GHSA-VMM5-FJGX-2JHP Apache CXF's WS-Transfer module has an insecure XML parser configuration

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

org.apache.cxf:apache-cxf (>=4.1.0, <=4.1.5), org.apache.cxf:cxf-distribution-javadoc (>=4.1.0, <=4.1.5) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=4.1.0, <=4.1.5)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =4.1.0, =4.1.0, =4.1.0, =4.1.5 Source cves: CVE-2026-44618 Source advisory: GHSA-VMM5-FJGX-2JHP...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: OSV:GHSA-VMM5-FJGX-2JHP...

org.apache.cxf:apache-cxf (>=4.1.0, <=4.1.5), org.apache.cxf:cxf-distribution-javadoc (>=4.1.0, <=4.1.5) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=4.1.0, <=4.1.5)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =4.1.0, =4.1.0, =4.1.0, =4.1.5 Source cves: CVE-2026-44618 Source advisory: OSV:GHSA-VMM5-FJGX-2JHP...

org.apache.cxf:apache-cxf (4.2.0), org.apache.cxf:cxf-distribution-javadoc (4.2.0) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (4.2.0)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-ws-transfer and may be impacted: - org.apache.cxf:apache-cxf 4.2.0 - org.apache.cxf:cxf-distribution-javadoc 4.2.0 Source cves:...

org.apache.cxf.systests:cxf-systests-jaxrs (2.6.13), org.apache.cxf.systests:cxf-systests-transport-jms (2.6.13) +6 more potentially affected by CVE-2026-44417 via org.apache.cxf:cxf-rt-transports-jms (2.6.13)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.6.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.6.13 -...