Security Bulletin: Multiple Vulnerabilities in IBM DevOps Build.

Summary Multiple vulnerabilities were addressed in IBM DevOps Build 7.2.0.0 Vulnerability Details CVEID:CVE-2026-49432 DESCRIPTION: Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP...

Security Bulletin: Multiple vulnerabilites in IBM Rational Build Forge.

Summary IBM Rational Build Forge 8.1.0.0 addresses multiple vulnerabilites Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for comma-separated values when comma: true is enabled, allowing attackers to cause denial-of-service via...

Exploit for Improper Authorization in Vercel Next.Js

React2Shell Scanner CVE-2025-29927 — Next.js Server Ac...

Security Bulletin: Vulnerabilities in Netty,Apache Log4j Core,Spring Boot,Spring Framework,PostCSS,tmp,Spring Data,Apache Commons Lang,React Router,Bootstrap,d3-color might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Apache Log4j Core, Spring Boot, Spring Framework, PostCSS, tmp, Spring Data, Apache Commons Lang, React Router, Bootstrap,d3-color. Vulnerabilities include The attacker can present a server certificate...

Security Bulletin: Vulnerabilities in Netty.Spring WebFlux,Spring Framework,Bootstrap,Angular,Lodash,spring-security-config,Underscore might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty.Spring WebFlux,Spring Framework,Bootstrap,Angular,Lodash,spring-security-config. Vulnerabilities include an escalation attack exchanging a known session ID for that of an authenticated user, Denial of...

Security Bulletin: Vulnerabilities in Netty,jackson-databind,Angular,bootstrap,React Router,decode-uri-component,Reactor Netty,Spring WebFlux,Spring Framework,spring-web might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, jackson-databind, Angular, bootstrap, React Router, decode-uri-component, Reactor Netty, Spring WebFlux, Spring Framework,spring-web. Vulnerabilities include allowing the renamed JSON key to be assigned...

Security Bulletin: Vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer. Vulnerabilities include a crafted Host header that is only a superstring match for a configured host+path key can still route a...

CVE-2026-103231

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-103231

A SQL injection vulnerability exists in the Order Cancellation component of the AdithyaYelloju Restaurant-Management-System (up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c). The flaw is located in the mysqli_query function within the User/cancel.php file, where manipulation of the ID argum...

CVE-2026-103231 AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-103231 AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

EUVD-2026-90074

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-103231 AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2026-42766 DESCRIPTION: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summar...

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...

GHSA-GFHX-HW2G-V5HG Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...

GHSA-P98J-92PF-MC4P DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

Summary In INPLACE mode DOMPurify sanitizes the caller's live DOM subtree directly. To close a known hazard GHSA-55q2-fjhq-7xh7, the library neutralizes any node a hook detaches during sanitization by stripping its subtree's non-allow-listed attributes, but this neutralization is wired only into...

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

Summary In INPLACE mode DOMPurify sanitizes the caller's live DOM subtree directly. To close a known hazard GHSA-55q2-fjhq-7xh7, the library neutralizes any node a hook detaches during sanitization by stripping its subtree's non-allow-listed attributes, but this neutralization is wired only into...

Exploit for CVE-2026-94545

CVE-2026-94545: Next.js next/og Unauthenticated Remote Code...

Improper Encoding or Escaping of Output

Overview satori is an Enlightened library to convert HTML and CSS to SVG. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the generation of its SVG output, which places certain input values into the document without neutralizing characters that are...