PT-2026-20435

Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: from 10.5 through 26.1...

CVE-2025-33135

IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform 3.0.0.0 through 3.0.5.4 Interim Fix 027 IBM Financial Transaction Manager for Check Services v3 Multiplatforms is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to...

CVE-2025-33135 IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multiple vulnerabilities

IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform 3.0.0.0 through 3.0.5.4 Interim Fix 027 IBM Financial Transaction Manager for Check Services v3 Multiplatforms is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to...

CVE-2025-33135

IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform 3.0.0.0 through 3.0.5.4 Interim Fix 027 IBM Financial Transaction Manager for Check Services v3 Multiplatforms is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to...

CVE-2025-33135

This CVE affects IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform releases 3.0.0.0 through 3.0.5.4 Interim Fix 027. The issue is a cross-site scripting vulnerability in the Web UI that allows an unauthenticated attacker to embed arbitrary JavaScript, potent...

CVE-2026-23597

Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well...

CVE-2026-23596

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...

CVE-2026-23598

CVE-2026-23598 involves vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API. The issue could allow an unauthenticated remote attacker to obtain sensitive information, including user accounts, roles, and system configuration, and to gain insight into internal se...

CVE-2026-23596

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...

CVE-2026-23647

The CVE-2026-23647 advisory describes Glory RBG-100 recycler systems using the ISPK-08 software with hard-coded operating-system credentials embedded across multiple local accounts, including admin-privileged ones. An attacker with network access to exposed services (e.g., SSH) can authenticate u...

Apple Tests End-to-End Encrypted RCS Messaging in iOS 26.4 Developer Beta

Apple on Monday released a new developer beta of iOS and iPadOS with support for end-to-end encryption E2EE in Rich Communications Services RCS messages. The feature is currently available for testing in iOS and iPadOS 26.4 Beta, and is expected to be shipped to customers in a future update for...

PT-2026-20308

Name of the Vulnerable Software and Affected Versions HPE Aruba Networking 5G Core versions affected versions not specified Description An issue exists in the API error handling of an HPE Aruba Networking 5G Core server API that could allow an unauthenticated remote attacker to obtain sensitive...

PT-2026-20243

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform versions 3.0.0.0 through 3.0.5.4 Interim Fix 027 Description The software is susceptible to cross-site scripting. An unauthenticated attacker can embed...

IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform 跨站脚本漏洞

IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform is a payment integration and processing platform provided by IBM. Version 3.0.0.0 to 3.0.5.4 Interim Fix 027 of IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform contain...

SUSE-SU-2026:0558-1 Security update for libnvidia-container

This update for libnvidia-container fixes the following issues: Update to version 1.18.0. Security issues fixed: - CVE-2024-0132: time-of-check time-of-use TOCTOU race condition in default configuration via specifically crafted container image bsc1231033. - CVE-2024-0133: data tampering in host...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the SAMLRequest DEFLATE decompression. An...

Security Bulletin: Due to use of Rhino JAR , IBM Sterling Connect:Direct Web Services is affected by high CPU consumption and a potential Denial of Service issue.

Summary rhino-1.7R4.jar is used by IBM Sterling Connect:Direct Web Services CVE-2025-66453. Vulnerability Details CVEID:CVE-2025-66453 DESCRIPTION: Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an...

Server-side Request Forgery (SSRF)

Overview MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the spliturl function in the mindsdb/utilities/security.py component. An attacker can bypass blocklist-based...

The vulnerability of the Windows Storage Services data storage service on Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Windows Storage Services data storage service in Windows operating systems is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to gain increased privileges...

CVE-2026-1249

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'loadlyricsajaxcallback' function. This makes it possible for authenticated attackers, with author level access and above, to mak...