Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to node modules axios, protobufjs, fast-xml-parser, follow-redirects, brace-expansion,...

CVE-2026-34909

creationtimestamp| type| source ---|---|--- 2026-05-22 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116617053903196416 2026-05-22 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmgg2g4mix26 2026-05-26 09:13:20+00:00| seen|...

CVE-2026-48238

creationtimestamp| type| source ---|---|--- 2026-05-21 19:09:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf4mwpxx22k...

CVE-2026-1815

Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation TEİAŞ Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a missing authentication and cross-site Scripting in NLTK [CVE-2026-33230, CVE-2026-33231]

Summary IBM Watson Speech Services Cartridge is vulnerable to a missing authentication in NLTK Natural Language Toolkit, due to an issue in nltk.app.wordnetapp that contains a reflected cross-site scripting issue in the lookup... route CVE-2026-33230, CVE-2026-33231. NLTK is used in our speech...

CVE-2026-1816

TEİAŞ’s Mobile Application is affected by CVE-2026-1816: an improper restriction of excessive authentication attempts that enables brute-force attacks. Affected versions are 1.6.2 up to 1.13 (not inclusive). The CVSS 3.1 baseline is 6.3 (MEDIUM) with network attack vector, low privileges required...

CVE-2026-1816

Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation TEİAŞ Mobile Application allows Brute Force. This issue affects Mobile Application: from 1.6.2 before 1.13...

CVE-2026-1816 OTP Bypass in TEİAŞ's Mobile Application

Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation TEİAŞ Mobile Application allows Brute Force. This issue affects Mobile Application: from 1.6.2 before 1.13...

EUVD-2026-31289

Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation TEİAŞ Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13...

CVE-2026-1815 Session Hijacking in TEİAŞ's Mobile Application

Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation TEİAŞ Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13...

CVE-2026-1815

TEİAŞ Mobile Application is affected by an Insufficient session expiration vulnerability (CVE-2026-1815) that enables session hijacking. Affected versions are 1.6.2 up to

MAL-2026-4620 Malicious code in nikou-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4634b70c99dd84c499d573350a00e86b09e8caaf34786d60b118ce12c64b426 utils/BotClient.js hardcodes a Feishu/Lark appId clia88b12e0b9b51013 and appSecret aBRv7CbiWuL7csrMavfLvc5sMW5B4Ky7 as default constructor values,...

CVE-2026-44069

creationtimestamp| type| source ---|---|--- 2026-05-21 10:28:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mme7jrhwsi2h 2026-06-01 00:01:28+00:00| seen| https://bsky.app/profile/slackers.it/post/3mn6rmpbzkd2n...

CVE-2026-48146

creationtimestamp| type| source ---|---|--- 2026-05-21 08:42:03+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-g6qx-g4pr-92v7 2026-05-27 19:40:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmub6xesu32c...

CVE-2026-22880 Mobile SSO authentication flow allows credential theft via malicious server

Mattermost Mobile Apps versions =2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO...

CVE-2026-2734

creationtimestamp| type| source ---|---|--- 2026-05-21 06:48:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdta7xnen2p...

CVE-2026-1543

creationtimestamp| type| source ---|---|--- 2026-05-21 06:43:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdsxbkkmi2n...

EUVD-2026-31200

Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor...

TEİAŞ Mobile Application 安全漏洞

TEİAŞ Mobile Application is a mobile application developed by the Turkish company TEİAŞ, which provides information and services related to power transmission operations. Versions of the TEİAŞ Mobile Application from 1.6.2 to 1.13 contained security vulnerabilities. These vulnerabilities were due...

tickets 跨站脚本漏洞

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the circular.php file, where the frmid POST parameter was directly inserted into...