Security Bulletin: IBM App Connect Enterprise is vulnerable to denial of service due to Node.js module axios (CVE-2026-25639)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to denial of service due to Node.js module axios. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.j...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') due to Lodash (CVE-2025-13465)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' due to Lodash. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash...

Investigating a New Click-Fix Variant

Disclaimer : This report has been prepared by the Threat Research Center to enhance cybersecurity awareness and support the strengthening of defense capabilities. It is based on independent research and observations of the current threat landscape available at the time of publication. The content...

CVE-2026-32381 WordPress App Landing Page theme <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through = 1.2.2...

CVE-2026-32381

Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through = 1.2.2...

CVE-2026-32381

CVE-2026-32381 affects the WordPress App Landing Page theme

CVE-2026-32381 WordPress App Landing Page theme <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through = 1.2.2...

CVE-2026-27275

creationtimestamp| type| source ---|---|--- 2026-03-13 06:00:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mgwaektfel22...

The vulnerability of the Windows App Client’s remote desktop client, related to insufficient verification of data authenticity, allows attackers to perform spoofing attacks.

The vulnerability of the Windows App Client’s remote desktop client is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

JumpServer 安全漏洞

JumpServer is an open-source bastion host provided by JumpServer Technology Co., Ltd. in Hangzhou, China. JumpServer has a security vulnerability, which stems from the insecure use of Jinja2 templates during the Applet and VirtualApp upload functions. This vulnerability could allow attackers with...

WordPress plugin App Landing Page 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. WordPress...

PT-2026-25228

Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through = 1.2.2...

CVE-2026-25076

creationtimestamp| type| source ---|---|--- 2026-03-12 23:15:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgvjr5dfbn2e...

CVE-2026-32269 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...

CVE-2026-32269 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...

CVE-2026-32269

Parse Server vulnerability CVE-2026-32269 affects deployments using the OAuth2 adapter with both appidField and appIds configured. The issue stems from incorrect validation of app IDs where a malformed value is sent to the token introspection endpoint instead of the user’s actual access token, po...

CVE-2026-32269 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...

@tinacms/app (>=0.0.0-20240725232152, <=2.0.3), @tinacms/cli (>=0.0.0-20240725232152, <=1.5.53) +1 more potentially affected by CVE-2026-28791 via tinacms (>=2.0.0, <=2.1.1)

tinacms NPM version =2.0.0, =0.0.0-20240725232152, =0.0.0-20240725232152, =0.0.35, =0.0.37 Source cves: CVE-2026-28791 Source advisory: OSV:GHSA-5HXF-C7J4-279C...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to remote code execution (CVE-2026-3455)

Summary IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to remote code execution. This bulletin provides patch information to address the reported vulnerability in Node.js module mailparsr CVE-2026-3455 Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Improper Input Validation due to node module qs (CVE-2025-15284)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Improper Input Validation due to node module qs. Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs parse modules...