Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities

Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java...

Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities

Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.1...

EUVD-2026-75878

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-15439: Improper Neutralization of Special Elements used in an SQL Command

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...

CVE-2026-2310

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-2310

IBM webMethods Integration Server 11.1 is vulnerable to an XML External Entity Injection (XXE) flaw when processing XML data, as described by CWE-91 (XML Injection). A remote attacker with low privileges and a local attack vector can exploit this to expose sensitive information or consume memory ...

CVE-2026-2310 IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-2310 IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-88028 Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can...

CVE-2026-88028 Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can...

CVE-2026-88027 Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

CVE-2026-88027

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

CVE-2026-88022 Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

EUVD-2026-75520

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

wagtail-embedvideos (5.1.0), wagtail-reoako (2.1.1) +2 more potentially affected by CVE-2026-55468 via wagtail (5.1.3)

wagtail PYPI version 5.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-embedvideos 5.1.0 - wagtail-reoako 2.1.1 - wagtail-spa-integration =2.1.0, =2.1.3 - wagtail-treemodeladmin 1.8.0 Source cves: CVE-2026-554...

cognee-integration-langgraph (>=0.1.0, <=0.1.3) potentially affected by CVE-2026-58473 via cognee (0.3.3)

cognee PYPI version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-integration-langgraph =0.1.0, =0.1.3 Source cves: CVE-2026-58473 Source advisory: OSV:PYSEC-2026-3816...

cognee-integration-crewai (0.1.0) potentially affected by CVE-2026-58473 via cognee (0.3.4)

cognee PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-integration-crewai 0.1.0 Source cves: CVE-2026-58473 Source advisory: OSV:PYSEC-2026-3816...

Improper Input Validation

Spring Integration is vulnerable to Improper Input Validation. The vulnerability is due to a non-thread-safe ScriptEngine instance being reused across concurrent message processing, potentially causing message data leakage between script evaluations or spurious exceptions...

[SECURITY] Fedora 43 Update: libsoup3-3.6.6-5.fc43

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications...

CVE-2026-88028: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can...