CVE-2026-54264 Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Servi...

CVE-2026-54268 Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function,...

EUVD-2026-38273

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function,...

CVE-2026-54268 Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function,...

CVE-2026-54268

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function,...

EUVD-2026-38271

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered SSR environments, Angular supports Hydration via...

CVE-2026-54266

Angular’s HttpTransferCache uses a weak 32‑bit DJB2‑like hash to generate TransferState cache keys, enabling hash collisions that let attackers overwrite a victim’s cached SSR responses (state poisoning and potential data leakage) by visiting crafted links. This affects Angular versions prior to ...

Security Bulletin: Vulnerability in Spring Framework affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Spring Framework has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2026-56450 AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...

EUVD-2026-38238

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to cause file paths to resolve outside the intended image,...

CVE-2026-56448 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to cause file paths to resolve outside the intended image,...

CVE-2026-56448

CVE-2026-56448 involves a path traversal in the AIL Framework. An authenticated user can craft object identifiers via the investigation workflow, causing path components to be joined with storage paths without ensuring the final path stays in the intended image/favicon/screenshot directories. Thi...

CVE-2026-56448 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to cause file paths to resolve outside the intended image,...

CVE-2026-56448 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to cause file paths to resolve outside the intended image,...

org.apache.nifi:nifi-framework-nar (0.7.1) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (0.7.1)

org.apache.nifi:nifi-jetty MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 0.7.1 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...

org.apache.nifi:nifi-framework-nar (0.6.1) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (0.6.1)

org.apache.nifi:nifi-jetty MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 0.6.1 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...

org.apache.nifi:nifi-framework-nar (1.0.0-beta) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.0.0-beta)

org.apache.nifi:nifi-jetty MAVEN version 1.0.0-beta is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.0.0-beta Source cves: CVE-2026-54665 Source advisory:...

org.apache.nifi:nifi-framework-nar (1.1.0) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.1.0)

org.apache.nifi:nifi-jetty MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.1.0 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...

org.apache.nifi:nifi-framework-nar (1.0.0) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.0.0)

org.apache.nifi:nifi-jetty MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.0.0 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...

org.apache.nifi:nifi-framework-nar (1.4.0) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.4.0)

org.apache.nifi:nifi-jetty MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.4.0 Source cves: CVE-2026-54665 Source advisory: OSV:GHSA-8VM2-C32J-MV...