28201 matches found
Security Bulletin: Multiple Vulnerabilities in IBM Event Streams
Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.1 Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untruste...
EUVD-2026-53680
An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling...
CVE-2026-16067: External Control of Assumed-Immutable Web Parameter
The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...
CVE-2026-67872: Uncontrolled Resource Consumption
An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling...
CVE-2026-66451: Authentication Bypass Using an Alternate Path or Channel
Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...
PT-2026-68447
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An Event Publisher output adapter logs irrelevant properties without sufficient validation or sanitization of the property values. An attacker with access to the...
PT-2026-68611
Name of the Vulnerable Software and Affected Versions Scripta eScriptorium versions prior to 26.04.2 Description Missing authorization in the websocket consumer allows a remote authenticated user to subscribe to the event stream of any document. This occurs because the object cls and object pk...
PT-2026-68567
Name of the Vulnerable Software and Affected Versions Agora versions prior to 2.0 Description The Agora Event & Conference WordPress Theme is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no P...
CVE-2026-0637: Insertion of Sensitive Information into Log File
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...
PT-2026-68658
The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...
CVE-2026-71320
creationtimestamp| type| source ---|---|--- 2026-08-05 22:28:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gvetvo5bbputq 2026-08-05 23:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msemzqxdjn2x 2026-08-06 01:31:21+00:00| seen|...
CVE-2026-71318
creationtimestamp| type| source ---|---|--- 2026-08-05 22:20:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dvfbxx3u4bdfr 2026-08-06 03:31:34+00:00| seen| https://gist.github.com/alon710/3d7b500e615305ceff4644e15070fc7a...
CVE-2026-68004
creationtimestamp| type| source ---|---|--- 2026-08-05 21:00:03+00:00| seen| Telegram/lFoBJsBJrsgLmESCPhvSqV0oex82MROWaDEk0EpTuUjmgWw 2026-08-06 00:00:09+00:00| published-proof-of-concept| Telegram/lFoBJsBJrsgLmESCPhvSqV0oex82MROWaDEk0EpTuUjmgWw 2026-08-18 20:10:04+00:00| seen|...
GHSA-FF2P-HMQR-HXM4
creationtimestamp| type| source ---|---|--- 2026-08-05 20:32:27+00:00| seen| https://gist.github.com/alon710/70dbe55592bff589cc8e0ec9c8957411...
CVE-2026-66298
creationtimestamp| type| source ---|---|--- 2026-08-05 20:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msedznuqkh2a 2026-08-11 04:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msrqhd2ijl23...
CVE-2026-9201
creationtimestamp| type| source ---|---|--- 2026-08-05 20:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msecwxolne2e...
CVE-2026-9196
creationtimestamp| type| source ---|---|--- 2026-08-05 20:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msecwr4gzi2b...
CVE-2026-9195
creationtimestamp| type| source ---|---|--- 2026-08-05 17:20:15+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzxqhflx2b 2026-08-06 16:15:56+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-781...
CVE-2026-10025 IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...
CVE-2026-10025 IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...