23767 matches found
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-66506 DESCRIPTION: Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to...
PT-2026-95920
Name of the Vulnerable Software and Affected Versions SAML Single Sign On WordPress plugin versions prior to 6.0.0 Description The plugin fails to honor the configured criterion for linking an incoming single sign-on identity to a WordPress account. It always resolves the identity by login name...
Security Bulletin: IBM On Call Manager Mobile Application is affected by a vulnerability in regular expression processing
Summary A vulnerability in the xmldom library affects regular expression processiong for the IBM On Call Manager Android and iOS mobile applications. Vulnerability Details CVEID:CVE-2026-34601 DESCRIPTION: xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and...
CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...
CVE-2026-54524
Frappe HR is an open-source human resources management solution HRMS. Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In...
AZL-105087 CVE-2026-44236 affecting package librabbitmq 0.14.0-1
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...
CVE-2026-44235
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...
CVE-2026-44236
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...
WordPress Single Sign On For TNG plugin < 2.2.0 - Unauthenticated Arbitrary Password Reset vulnerability
Unauthenticated Arbitrary Password Reset vulnerability discovered by moonge in WordPress Plugin Single Sign On For TNG versions 2.2.0...
CVE-2026-62108
Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...
CVE-2026-62108
CVE-2026-62108 is an unauthenticated Broken Authentication vulnerability in the Headless Single Sign On WordPress plugin, affecting versions 1.7.0 and earlier . Discovered by Joost Grunwald and scored 9.8 (CRITICAL) via CVSS 3.1 (network vector, no privileges or user interaction required, high im...
EUVD-2026-81491
Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...
CVE-2026-62108 WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...
CVE-2026-62108 WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...
CVE-2026-82759
Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1 computes ...
Malicious code in jwt-on-superagent-ora (npm)
The package jwt-on-superagent-ora was found to contain malicious code. --- Credit: OpenSSF source...
CVE-2026-25278
CVE-2026-25278 is a TOCTOU race condition in Qualcomm's automotive software platform based on QNX . The vulnerability occurs during I2C transfer request processing , where a race between memory allocation and data copying leads to memory corruption . The CVSS v3.1 score is 7.8 (High) with a local...
PT-2026-94417
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto acomp component where ACOMP REQUEST ON STACK reserves insufficient storage for asynchronous fallbacks. When an async implementation is selected, the acomp...
