Security Bulletin: Vulnerability in Axios affect IBM Cloud Pak System

Summary Due to the use of Axios, vulnerability was addressed in IBM Cloud Pak System version 2.3.5.1 Vulnerability Details CVEID:CVE-2026-44495 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollutio...

CVE-2026-76274

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

CVE-2026-76276

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

CVE-2026-76271

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...

CVE-2026-76267

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

Security Bulletin: Due to use of NodeJS, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Due to use of NodeJS libraries, IBM Cloud Pak System Software is affected by multiple vulnerabilities. These have been addressed in IBM Cloud Pak System Software version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-22036 DESCRIPTION: Undici is an HTTP/1.1 client for Node.js. Prior to...

EUVD-2026-94628

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

CVE-2026-76276

Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10 are vulnerable to an information disclosure flaw in the Discover Splunk Observability Cloud app via Splunk Web. A low-privileged user lacking "admin" or "power" roles can retrieve the app's original source code because production JavaSc...

CVE-2026-76276 Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...

CVE-2026-76274

Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 are vulnerable to a Server-Side Request Forgery (SSRF) within the Splunk App for Splunk Observability Cloud . An attacker with a role possessing the read_o11y_content capability can exploit the REST API to redirect outbound requests t...

EUVD-2026-94626

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

CVE-2026-76274 Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

CVE-2026-76271

The Discover Splunk Observability Cloud app for Splunk Enterprise is vulnerable to a Denial of Service (DoS) condition in versions below 10.4.3 , 10.2.7 , and 10.0.10 (note: 9.4.x is not affected). A low-privileged user without "admin" or "power" roles can exploit the issue by submitting input to...

CVE-2026-76271 Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...

EUVD-2026-94623

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...

CVE-2026-76267 Log Injection through the REST API in Splunk App for Splunk O11y Cloud

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

CVE-2026-76267

In Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 , a log injection vulnerability exists within the Splunk App for Splunk O11y Cloud . An attacker with the read_o11y_content capability can inject forged entries into the application log via the REST API . This occurs because the ap...

Cross-site Scripting (XSS)

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...

@adenta/cms (>=0.0.6, <=1.1.1-0), @otherdev-software/canvas (1.0.0) potentially affected by CVE-2026-105862 via @payloadcms/payload-cloud (>=3.53.0, <=3.61.0)

@payloadcms/payload-cloud NPM version =3.53.0, =0.0.6, =1.1.1-0 - @otherdev-software/canvas 1.0.0 Source cves: CVE-2026-105862 Source advisory: SNYK:JS-PAYLOADCMSPAYLOADCLOUD-20570519...

Arbitrary File Upload

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...