Security Bulletin: Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities in IBM Cloud Pak System

Summary Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities were found in Cloud Pak SystemCVE-2026-3295, CVE-2023-38375, CVE-2026-3161,CVE-2026-4418. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...

ROOT-APP-MAVEN-CVE-2026-40982 CVE-2026-40982 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-40982 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40981 CVE-2026-40981 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-40981 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22739 CVE-2026-22739 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-22739 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41002 CVE-2026-41002 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-41002 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Due to use of WebSphere Application Server - Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...

BIT-KYVERNO-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

Security Bulletin: Due to use of VMware ESXi and vCenter, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Vulnerabilities in VMware ESXi and vCenter affect IBM Cloud Pak System. IBM Cloud Pak System version 2.3.6.2 has addressed these vulnerabilities. Cloud Pak Sytem has updated Platform System Manager PSM and workload nodes to VMware ESXi 83U3k and VMware vCenter to VCSA 83U3k. Vulnerability...

Meari IoT Cloud Platform OpenAPI Service

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. 2. RECOMMENDED...

ROOT-APP-MAVEN-CVE-2025-41253 CVE-2025-41253 in org.springframework.cloud:spring-cloud-gateway-server - Patched by Root

Root has patched CVE-2025-41253 in the org.springframework.cloud:spring-cloud-gateway-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-41243 CVE-2025-41243 in org.springframework.cloud:spring-cloud-gateway-server-webflux - Patched by Root

Root has patched CVE-2025-41243 in the org.springframework.cloud:spring-cloud-gateway-server-webflux package for Root:Maven. Multiple fixed versions available...

EUVD-2025-209815

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting in loss of confidentiality or availability...

EUVD-2025-209813

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

EUVD-2025-209814

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

CVE-2026-56661: Server-Side Request Forgery (SSRF)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...

CVE-2026-55232: Server-Side Request Forgery (SSRF)

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

PT-2026-103976

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.6 Description The SSRF guard in the CMS resolves hosts using an IPv4-only function and fails to inspect IPv6 addresses. Consequently, any host lacking an A record bypasses the private-range check. An authenticated...

Rocky Linux 8 [CIQ] Security Update: cloud-init (crlsa-2021_3081)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20213081 advisory. cloud-init: randomly generated passwords logged in clear-text to world-readable file CVE-2021-3429 Tenable has extracted the preceding description block directly fr...

PT-2026-104070

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to access the complete device shadow of any device. By specifying a device...

AlmaLinux 9.6 [TuxCare] Security Update: cloud-init (ALMALINUX9.6:CLSA-2026:1779098063)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779098063 advisory. - cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions,...