Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in json

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in json Vulnerability Details CVEID:CVE-2026-71847 DESCRIPTION: Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parsing process. An attacker can bypass front-end controls, capture another user's headers, or poison a cache by sending requests with differing duplicate Content-Length headers, especially when th...

CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

EUVD-2026-79940

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-81926

Concrete CMS versions 9.4.0 through 9.5.2 contain a cross-site scripting (XSS) vulnerability in the location panel's duplicate-path confirmation dialog . When a page path collision occurs, the panel's check endpoint returns the submitted path unmodified in its JSON response, and client-side JavaS...

CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-69217

Http4s (a Scala HTTP service interface) is vulnerable to CL.CL request smuggling due to its Ember HTTP/1.1 parser accepting differing duplicate Content-Length headers and using the last value instead of rejecting the message. Affected versions are prior to 0.23.35 and 1.0.0-M47 . When an Ember se...

EUVD-2026-79193

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different...

CVE-2026-69217 Http4s: Ember Server accepts duplicate Content-Length headers

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different...

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, causing the server to treat a request as having no message body and parse the chunked body as a subsequent request. When Tornado is deployed behind a proxy, this inconsistency enables HTTP request smuggling , which can lea...

CVE-2026-91926

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AVPAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AVPAIR type appear...

CVE-2026-52822 Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/id/restart, PATCH /api/timesheets/id/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked...

CVE-2026-52822 Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/id/restart, PATCH /api/timesheets/id/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked...

CVE-2026-91859 MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, accessMonitor calls AccessLog::logRequest twice for one...

CVE-2026-81926: Improper Neutralization of Input During Web Page Generation

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

PT-2026-93123

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.4.0 through 9.5.2 Description Concrete CMS fails to escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The check endpoint returns the submitted path unmodified ...

CVE-2026-54541

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...