CVE-2026-4413: Improper Neutralization of Input During Web Page Generation

IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36069

Summary The Web UI and REST interfaces did not properly invalidate active user sessions after security-sensitive account changes, including password changes, password resets, or role and privilege updates, allowing previously issued session tokens to remain valid and potentially be reused to acce...

Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36252

Summary The Web UI did not generate a new session identifier following successful user authentication, allowing a pre-authentication session identifier to remain associated with the authenticated session. An attacker who could obtain or cause a user's browser to use a known session identifier...

Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2026-19178

Summary The Web UI and REST interfaces allowed users with administrative-level role-mapping privileges to modify their own role mapping, creating a race condition in which a user could potentially preserve or restore elevated privileges while an administrator was changing the user's role. This...

Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36061

Summary The Web UI allowed an authenticated user with administrative privileges to generate a large number of email notifications by submitting multiple user creation requests, potentially resulting in email flooding and impacting the readability and usability of recipients' mailboxes. The issue...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-101895 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-101895 via @angular/platform-server (18.2.13)

@angular/platform-server NPM version 18.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.0, =1.0.4 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

CVE-2026-109967

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an...

CVE-2026-109966

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

CVE-2026-109967 yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an...

CVE-2026-109967

The software yt-dlp-web-ui (versions through 4.0.0 ) contains a NULL pointer dereference vulnerability within the Service.Formats JSON-RPC method . A remote unauthenticated attacker can cause a Denial of Service (DoS) by sending a single request with a URL value such as --version. This input trig...

CVE-2026-109967 yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an...

CVE-2026-109967

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an...

CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...