Security Bulletin: Maximo AI Service uses client-java-21.0.0.jar which is vulnerable to CVE-2026-15687.

Summary Maximo AI Service uses client-java-21.0.0.jar which is vulnerable to CVE-2026-15687. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-15687 DESCRIPTION: A security issue was discovered in the Kubernetes Java client librar...

BIT-RABBITMQ-2026-67224 RabbitMQ: Admin path-traversal write via trace name

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...

BIT-DISCOURSE-2026-91123 Discourse: Reject literal backslash path separators in iframe src traversal guard

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser...

CVE-2026-103664

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-14995

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

EUVD-2026-90578

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2023-32315-EXPLOIT

CVE-2023-32315 - Bypass de Autenticación en Openfire Este repositorio destaca un problema de seguridad grave que afecta a varias versiones de Openfire. Openfire, un servidor de colaboración en tiempo real multiplataforma que utiliza el protocolo XMPP desarrollado por la comunidad Ignite Realtime,...

CVE-2026-14995 Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-14995 Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-14995

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.15.1 . The root cause is insufficient input sanitization and output escaping when handling the REQUEST_URI Path . An unauthenticated attacker can inject arbitrary web sc...

EUVD-2026-90560

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers , including Apeos C4571 (version 1.1.3 and earlier) and Apeos C3567 (version 1.1.3). The root cause is the insecure handling of externally supplied parameters , which may allow a s...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

EUVD-2026-90549

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

Unauthenticated Arbitrary File Disclosure

org.apache.wicket, wicket-core is vulnerable to an unauthenticated arbitrary file disclosure. The vulnerability is due to improper validation of attacker-controlled locale, style, and variation URL attributes before they are appended to the resource path, which allows an attacker to use path...