Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution (CVE-2025-13465, CVE-2025-61140) and denial of service (CVE-2025-15284)

Summary Node.js modules lodash, qs and jsonpath are used by IBM App Connect Enterprise Certified Container. All IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution CVE-2025-13465, CVE-2025-61140 and denial of service CVE-2025-15284. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.21 LTS and 12.21.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

CVE-2026-3465

A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruisetime causes denial of service. Remote exploitation of the attack is possible. The...

CVE-2026-3465 Tuya App/SDK JSON Data Point denial of service

A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruisetime causes denial of service. Remote exploitation of the attack is possible. The...

CVE-2026-3465

The CVE-2026-3465 entry concerns Tuya App and SDK 24.07.11 on Android. It cites a vulnerability in the JSON Data Point Handler where manipulating the cruise_time argument can cause a denial of service. The attack is described as remotely exploitable with high attack complexity, and exploitation i...

CVE-2026-3465

A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruisetime causes denial of service. Remote exploitation of the attack is possible. The...

CVE-2026-3465 Tuya App/SDK JSON Data Point denial of service

A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruisetime causes denial of service. Remote exploitation of the attack is possible. The...

EUVD-2026-9297

A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruisetime causes denial of service. Remote exploitation of the attack is possible. The...

CVE-2026-1628

Mattermost Desktop App versions =5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server...

CVE-2026-1492

creationtimestamp| type| source ---|---|--- 2026-03-03 06:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116163715191061674 2026-03-03 06:00:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mg53ptextu2u 2026-03-03 07:26:16+00:00| seen|...

CVE-2021-35485

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the...

EUVD-2021-22125

The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an...

PT-2026-22794

IBM App Connect Operator versions CD 11.3.0 through 11.6.0 and 12.1.0 through 12.20.0, LTS versions 12.0.0 through 12.0.20, and IBM App Connect Enterprise Certified Containers Operands versions CD 12.0.11.2‑r1 through 12.0.12.5‑r1 and 13.0.1.0‑r1 through 13.0.6.1‑r1, and LTS versions 12.0.12‑r1...

PT-2026-22746

Name of the Vulnerable Software and Affected Versions Tuya App and SDK version 24.07.11 Description A denial of service condition exists in Tuya App and SDK. The issue affects an unknown functionality within the JSON Data Point Handler component. Manipulation of the cruise time argument can lead ...

IBM App Connect Operator和IBM App Connect EnterpriseCertified Containers Operands 安全漏洞

IBM App Connect Operator and IBM App Connect EnterpriseCertified Containers Operands are both products of International Business Machines Corporation IBM. IBM App Connect Operator is an automated management program. IBM App Connect EnterpriseCertified Containers Operands is an enterprise-level...

Tuya App和Tuya SDK 安全漏洞

Both the Tuya App and Tuya SDK are products of the Chinese company Tuya. The Tuya App is a smart home control terminal. The Tuya SDK is a developer toolkit. There are security vulnerabilities in the 24.07.11 version of both the Tuya App and Tuya SDK. These vulnerabilities stem from incorrect...

CVE-2026-0028

creationtimestamp| type| source ---|---|--- 2026-03-02 19:57:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3zytp27q2e 2026-03-02 21:20:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg46naifqq2v...

CVE-2026-21853

creationtimestamp| type| source ---|---|--- 2026-03-02 19:18:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3xtoe7yt2s 2026-03-02 19:18:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3xtzdyf52c 2026-03-02 19:18:52+00:00| seen|...

CVE-2026-21853

AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This vulnerability can be exploited by embedding a specially crafted affine: URL on a website. An attacker can trigger the vulnerability in tw...

CVE-2026-0015

In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...