Exploit for Improper Authentication in Oracle Concurrent_Processing

markdown CVE-2025-61882 – Oracle E-Business Suite Remote Co...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Out-of-bounds Write due to OpenSSL (CVE-2025-15467)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS Database node users are vulnerable to Out-of-bounds Write due to OpenSSL. Vulnerability Details CVEID:CVE-2025-15467 DESCRIPTION: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-25645 DESCRIPTION: Requests is a HTTP library...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses h2-4.1.0-py3-none-any.whl which is vulnerable to CVE-2025-57804

Summary IBM Maximo Application Suite - Visual Inspection component uses h2-4.1.0-py3-none-any.whl which is vulnerable to CVE-2025-57804. This bulletin contains information regarding the vulnerability and its remediation Vulnerability Details CVEID:CVE-2025-57804 DESCRIPTION: h2 is a pure-Python...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses urllib3-2.6.3-py3-none-any.whl which is vulnerable to CVE-2026-44431, CVE-2026-44432

Summary IBM Maximo Application Suite - Visual Inspection component uses urllib3-2.6.3-py3-none-any.whl which is vulnerable to CVE-2026-44431, CVE-2026-44432, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-44431 DESCRIPTION:...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certifcate Manager

Summary Navigator for IBM i uses DOMPurify for cross-site scripting sanitization. DOMPurify is vulnerable to prototype pollution-based XSS bypass CVE-2026-41238, skipped sanitization in non-string mode CVE-2026-41239, and skipped sanitization when using the ADDTAGS function CVE-2026-41240...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses redis-5.2.1-py3-none-any.whlwhich is vulnerable to CVE-2021-31294

Summary IBM Maximo Application Suite - Visual Inspection component uses redis-5.2.1-py3-none-any.whlwhich is vulnerable to CVE-2021-31294 , This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2021-31294 DESCRIPTION: Redis before...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses setuptools which is vulnerable to CVE-2024-6345

Summary IBM Maximo Application Suite - Visual Inspection component uses setuptools which is vulnerable to CVE-2024-6345, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2024-6345 DESCRIPTION: A vulnerability in the packageindex...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in qs

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in qs. CVE-2026-2391 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for...

Security Bulletin: Log4j Core TLS hostname verification bypass via verifyHostName XML attribute allows man-in-the-middle attacks on SMTP/Socket/Syslog appenders.

Summary Vulnerabilities have been identified in Apache Log4j Core affecting TLS security and log integrity. The first leaves TLS hostname verification silently ineffective through version 2.25.3, exposing SMTP, Socket, and Syslog appenders to man-in-the-middle attacks. The second introduces CRLF...

Security Bulletin: Log4j Core TLS hostname verification bypass via verifyHostName XML attribute allows man-in-the-middle attacks on SMTP/Socket/Syslog appenders.

Summary Vulnerabilities have been identified in Apache Log4j Core versions up to 2.25.3 affecting TLS security, log integrity, and XML output handling. The first exposes SMTP, Socket, and Syslog appenders to man-in-the-middle attacks due to silently ineffective hostname verification; the second...

Security Bulletin: Log4j Core TLS hostname verification bypass via verifyHostName XML attribute allows man-in-the-middle attacks on SMTP/Socket/Syslog appenders.

Summary Vulnerabilities have been identified in Apache Log4j Core versions up to 2.25.3 and the Log4j 1-to-2 bridge, covering TLS hostname verification bypass, CRLF log injection, and malformed XML output due to improper character escaping. Collectively, these issues expose applications to...

Security Bulletin: CVE-2025-48924 – Apache Commons Lang Uncontrolled Recursion DoS (StackOverflowError)

Summary A denial-of-service vulnerability exists in Apache Commons Lang due to uncontrolled recursion. When supplied with a sufficiently long input string, these methods can trigger a StackOverflowError. The vulnerability affects commons-lang:commons-lang versions 2.0–2.6 and...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow (CVE-2026-11594, CVE-2026-11707, CVE-2026-11383, CVE-2026-11541, CVE-2026-11536)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses requests-2.32.4-py3-none-any.whl which is vulnerable to CVE-2026-25645

Summary IBM Maximo Application Suite - Visual Inspection component uses requests-2.32.4-py3-none-any.whl which is vulnerable to CVE-2026-25645. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-25645 DESCRIPTION: Requests is a...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl which is vulnerable to CVE-2026-34073, CVE-2026-39892

Summary IBM Maximo Application Suite - Visual Inspection component uses cryptography-46.0.5-cp311-abi3-manylinux234x8664.whl which is vulnerable to CVE-2026-34073, CVE-2026-39892, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details...

Symlink Attack

Overview acl is a None Affected versions of this package are vulnerable to Symlink Attack. via the libacl functions. An attacker can gain unauthorized access to or modify access control lists by replacing a pathname component with a symbolic link, redirecting ACL read or write operations to...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview acl is a None Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. in the getfacl or setfacl process. An attacker can gain unauthorized access to files or escalate privileges by exploiting a race condition where a symbolic link replaces a...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...