Security Bulletin: The IBM Common Licensing product using WebSphere Application Server Liberty is affected by a remote code execution vulnerability (CVE-2025-14914)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a cross-site scripting vulnerability with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, or servlet-6.0 feature enabled, due to improper validation of user-supplied input. An attacker could...

CVE-2026-11664 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-47838

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7....

Malicious code in @coterie-baby/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0f46407e3ad7d060630b7aec9ce77a68f41c3a9fd3678941d6d43ca78b68a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5654 Malicious code in @coterie-baby/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0f46407e3ad7d060630b7aec9ce77a68f41c3a9fd3678941d6d43ca78b68a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-6277

creationtimestamp| type| source ---|---|--- 2026-06-11 12:45:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260612...

CVE-2026-41699

creationtimestamp| type| source ---|---|--- 2026-06-11 08:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnyr2ucwjy2n 2026-06-11 09:26:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnyvujrrsc2i 2026-06-14 23:17:06+00:00| seen|...

CVE-2026-46520

creationtimestamp| type| source ---|---|--- 2026-06-11 05:02:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnygzyjcyh2n...

Malicious code in @coze-common/chat-area (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89b49d08422192fa57b4739bf462f0e8b3c206b2c3cfad15578ac92dd6f47b04 This package is a dependency-confusion/namespace-squat against ByteDance's @coze-common scope. The library is hollow — index.js is module.exports = a...

CVE-2026-45257

creationtimestamp| type| source ---|---|--- 2026-06-10 21:43:33+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnxoldhoq72z 2026-06-10 22:08:57+00:00| seen| https://bsky.app/profile/andersonc0d3.bsky.social/post/3mnxpyp62lc2t 2026-06-11 00:53:06+00:00| seen|...

CVE-2026-46612

creationtimestamp| type| source ---|---|--- 2026-06-10 19:17:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxgfz4oop24...

Malicious Package

Overview npmjsweb3-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-5510 Malicious code in npmjs_web3-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b691e4c1a13cf8174fdf8653d757594f18057650310bc89e376caa806602d3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview npmjshardhat-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview npmjsethers-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-47913

creationtimestamp| type| source ---|---|--- 2026-06-10 09:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnwdxp5yde2q...

CVE-2026-10024

creationtimestamp| type| source ---|---|--- 2026-06-10 07:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnw645v6uw2l...

Vulnerability in Cosminexus HTTP Server and Hitachi Web Server

Overview Vulnerability has been found in Cosminexus HTTP Server and Hitachi Web Server. CVE-2025-65082 This vulnerability will not occur if CGI is not used. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information'...

EUVD-2026-35911

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7....

GHSA-293Q-567P-WMWQ Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

In Spring Security Web, SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...