Security Bulletin: Security Misconfiguration Vulnerability in Spring Security Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22748)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-22748 DESCRIPTION: Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecode...

CVE-2026-89251

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to JwtRequestCodeFilter copying security-sensitive claims from a signed request JWT into the authorization parameter map without proper validation, which allows an attacker with a validly signed JWT to replace...

CVE-2026-84325

A flaw was found in chromium-browser. This improper input validation vulnerability in the DataTransfer component allows a remote attacker, through social engineering, to bypass system access restrictions by leveraging a co-installed application. This could lead to unauthorized access to sensitive...

CVE-2026-88260

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM Build 109...

CVE-2026-88260

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM Build 109...

CVE-2026-88260

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM Build 109...

CVE-2026-88260

Brainzcompany Zenius EMS 8.0 (through OAM Build 109) is affected by a combination of authentication bypass using an alternate path or channel and improper validation of syntactic correctness of input , resulting in Remote Code Inclusion . The CVSS 4.0 score is 8.7 (HIGH) , with an adjacent networ...

EUVD-2026-75923

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM Build 109...

ROS-20260911-73-0212

The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0224

The vulnerability of the Glic component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0178

The vulnerability of the Guest mode in Google Chrome browser is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to carry out spam attacks using a specially created HTML page...

PT-2026-90373

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel libceph, the osd sparse read function in net/ceph/osd client.c fails to validate that each OSD-supplied extent is monotonic and remains within the original request...

ROS-20260911-73-0205

The vulnerability in the Google Chrome web browser is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure using a malicious file...

ROS-20260911-73-0054

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to bypass the sandboxing protection mechanisms...

ROS-20260911-73-0210

The vulnerability of the DevTools suite for web development in the Google Chrome browser is related to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions through a specially created HTML page...

ROS-20260911-73-0056

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially crafted HTML page...

Apache ActiveMQ < 5.19.11 / 6.x < 6.3.2 clientId Spoofing

The version of Apache ActiveMQ running on the remote host is prior to 5.19.11 or 6.x prior to 6.3.2. It is, therefore, affected by a spoofing vulnerability: - Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107327)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107327 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Add check for srq maxsge attribute maxsge attribute is passed by the user, and is...

ROS-20260911-73-0185

The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...