CVE-2026-71204: Improper Access Control

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-8400: Use of Externally-Controlled Input to Select Classes or Code

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 XSS (7281641)

The version of IBM WebSphere Application Server running on the remote host is affected by a XSS vulnerability as referenced in the 7281641 advisory. - IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization...

IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 (7281628)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7281628 advisory. - IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

CVE-2026-13227 ERPNext v16.25.0 - Improper authorization in Prospect opportunities API

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...

CVE-2026-66902

Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as "system$command", a single argument call that passes the whol...

CVE-2026-70475

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission middleware that protects other execution endpoints. Any authenticated use...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a security bypass vulnerability (CVE-2026-10842)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a security bypass vulnerability with the appSecurity-1.0, appSecurity-2.0 , appSecurity-3.0 or appSecurity-4.0 feature enabled...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a security bypass vulnerability (CVE-2026-10842)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a security bypass vulnerability with the appSecurity-1.0, appSecurity-2.0 , appSecurity-3.0 or appSecurity-4.0 feature enabled. Vulnerability...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a denial of service vulnerability (CVE-2026-15057)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a denial of service vulnerability due to an out-of-bounds write when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details Ref...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0,...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an authentication bypass (CVE-2026-16184)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an authentication bypass. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and Versions...

EUVD-2026-52790

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an authentication bypass (CVE-2026-16184)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an authentication bypass. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and Versions|...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation (CVE-2026-14446)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed i...