Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-93749 DESCRIPTION:...

0-logger (>=1.0.0, <=1.1.1), 0xkarl-everscale (0.7.5) +3377 more potentially affected by CVE-2026-17495 via moment (>=2.29.2, <=2.30.1)

moment NPM version =2.29.2, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.74, =0.0.14, =2.71.3, =3.19.3, =7.10.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-17495 Source advisory: GHSA-4P3W-J4W9-5JQW...

EUVD-2026-78277

moment vulnerable to Path Traversal via crafted non-string locale name...

0-logger (>=1.0.0, <=1.1.1), 0xkarl-everscale (0.7.5) +3377 more potentially affected by CVE-2026-17495 via moment (>=2.29.2, <=2.30.1)

moment NPM version =2.29.2, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.74, =0.0.14, =2.71.3, =3.19.3, =7.10.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-17495 Source advisory: OSV:GHSA-4P3W-J4W9-5JQW...

GHSA-4P3W-J4W9-5JQW moment vulnerable to Path Traversal via crafted non-string locale name

Impact moment before 2.31.0 is vulnerable to path traversal in moment.locale. When an application passes a non-string, attacker-influenced value to moment.locale, a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. Thi...

NPM: moment vulnerable to Path Traversal via crafted non-string locale name

NPM: moment vulnerable to Path Traversal via crafted non-string locale name vulnerability discovered by ? in WordPress Npm moment versions = 2.29.2, 2.31.0...

moment vulnerable to Path Traversal via crafted non-string locale name

Impact moment before 2.31.0 is vulnerable to path traversal in moment.locale. When an application passes a non-string, attacker-influenced value to moment.locale, a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. Thi...

CLEANSTART-2026-FU60890 moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates

Security vulnerability affects the argo-workflows package. moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates...

PT-2026-108405

Security vulnerability affects the argo-workflows package. moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates...

SUSE CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

Directory Traversal

Overview moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of this package are vulnerable to Directory Traversal in the locale function, whose locale name validation is circumvented by a non-string value, so an object ca...

0-logger (>=1.0.0, <=1.1.1), 0xkarl-everscale (0.7.5) +13541 more potentially affected by CVE-2022-24785 +1 more via moment (>=2.0.0, <=2.30.1)

moment NPM version =2.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.0.1, =0.2.4, =0.2.0, =1.0.0, =1.0.0, =0.0.1, =4.11.0, =1.17.6-next.0, =1.18.4 and more Source cves: CVE-2022-24785, CVE-2026-17495 Source advisory: SNYK:JS-MOMENT-19821607...

Directory Traversal

Overview org.webjars.npm:moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of this package are vulnerable to Directory Traversal in the locale function, whose locale name validation is circumvented by a non-string value,...

CVE-2026-17495

A flaw was found in moment, a JavaScript library for handling dates. A remote attacker could exploit this vulnerability by providing a specially crafted input to the moment.locale function. This input, which is not a standard text string, can bypass security checks designed to prevent unauthorize...

DEBIAN-CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

UBUNTU-CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

0-logger (>=1.0.0, <=1.1.1), 0xkarl-everscale (0.7.5) +3377 more potentially affected by CVE-2026-17495 via moment (>=2.29.2, <=2.30.1)

moment NPM version =2.29.2, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.74, =0.0.14, =2.71.3, =3.19.3, =7.10.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-17495 Source advisory: MEND:CVE-2026-17495...