CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

CVE-2026-14446

IBM WebSphere Application Server 9.0 and 8.5 are reported vulnerable to broken access control/privilege escalation in the administrative console. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a base score of 9.8 (CRITICAL). Impact relates to confidentiality, integrity, and avai...

EUVD-2026-50064

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

CVE-2026-59942 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...

OPENSUSE-SU-2026:21470-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. - CVE-2026-46968: unauthorized creation, deletion or modification...

CVE-2026-57510

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

EUVD-2026-36073

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks...

CVE-2026-16581

In igloohome Smart Lock Mobile App versions 3.2.3 and earlier, the CVE-2026-16581 describes an Inclusion of Sensitive Information in Source Code that could allow an unauthorized actor to access functions or backend services not sufficiently protected by authentication controls. The affected softw...

EUVD-2026-50021

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...

CVE-2026-6881 Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...

CVE-2026-16347 Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed...

cowboy: Cowboy: Denial of Service via HTTP/1.1 duplicate header names

A flaw was found in Cowboy. An unauthenticated remote attacker can exploit this vulnerability by sending multiple HTTP/1.1 header lines with the same name. This bypasses the maxheaders limit, causing the connection process memory to grow uncontrollably. This can lead to memory exhaustion and a...

EUVD-2026-50014

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 stores potentially sensitive information in log files that could be read by a...

CVE-2026-55555 Dompdf: File existence oracle via font-face stylesheet declaration

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...

CVE-2026-55555

Dompdf (versions ≤3.15) is vulnerable to a File Existence Oracle via the CSS @font-face directive, allowing an attacker to probe local files using file:// references and trigger memory exhaustion. The vulnerability hinges on observable differences: when a referenced local file exists, Dompdf proc...

Security Bulletin: Unauthenticated User Could Gain Remote Access to TS3100/TS3200 (CVE-2016-9005)

Summary IBM TS3100/TS3200 Tape Library could allow an unauthenticated user, with access to the company network, to change a user's password and gain remote access to the system. Vulnerability Details CVEID:CVE-2016-9005 DESCRIPTION: IBM TS3100-TS3200 Tape Library could allow an unauthenticated...

Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access (CVE-2011-1372)

Abstract Administrative access to the library may be obtained without supplying proper credentials. Content Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access CVE-2011-1372 SUMMARY: Administrative access to the library may be obtained...

CVE-2026-4912

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

DEBIAN-CVE-2026-50736

The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party actin...