CVE-2026-54724 Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint

Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and affect WebSphere Application Server Liberty when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are enabled. Vulnerability Details Refer to the security...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server Liberty is affected by an authenication bypass (CVE-2026-14525)

Summary IBM WebSphere Application Server Liberty is affected by an authenication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server Liberty is affected by a privilege escalation (CVE-2026-18499)

Summary IBM WebSphere Application Server Liberty is affected by a privilege escalation with the collectiveController-1.0 or collectiveMember-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server Liberty is affected by a denial of service (CVE-2026-10571)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with the restConnector-2.0 feature enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

gha-lab-227431b300

Kiwi TCMS - Open-Source-Testmanagement .. image:: https://img.shields.io/docker/pulls/kiwitcms/kiwi :target: https://kiwitcms.readthedocs.io/en/latest/installingdocker.html :alt: Downloads from Docker Hub .. image:: https://readthedocs.org/projects/kiwitcms/badge/?version=latest :target:...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by remote code execution and HTTP request smuggling. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1,...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by uncontrolled resource consumption and denial of service CVE-2026-50645, CVE-2026-9322, CVE-2026-9171. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1,...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected affected by a server-side request forgery vulnerability (CVE-2026-11546)

Summary IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a denial of service vulnerability (CVE-2026-15057)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability due to an out-of-bounds write when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack...

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty could provide weaker than expected security (CVE-2025-14917)

Summary IBM WebSphere Application Server Liberty could provide weaker than expected security administering security settings when the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature is enabled. Following IBM Engineering Lifecycle Management products a...

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Test management is impacted by multiple vulnerabilities

Summary A vulnerability has been identified in jackson-databind library, which is used in IBM Engineering Lifecycle Management - Engineering Test management Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource...

com.tikalk.hudson.plugins:notification (1.10), org.jenkins-ci.main:jenkins-test-harness (1.605) +5 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.605)

org.jenkins-ci.main:jenkins-core MAVEN version 1.605 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.tikalk.hudson.plugins:notification 1.10 - org.jenkins-ci.main:jenkins-test-harness 1.605 -...

com.tikalk.hudson.plugins:notification (1.10), org.jenkins-ci.main:jenkins-test-harness (1.605) +5 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.605)

org.jenkins-ci.main:jenkins-core MAVEN version 1.605 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.tikalk.hudson.plugins:notification 1.10 - org.jenkins-ci.main:jenkins-test-harness 1.605 -...

com.tikalk.hudson.plugins:notification (1.10), org.jenkins-ci.main:jenkins-test-harness (1.605) +5 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (1.605)

org.jenkins-ci.main:jenkins-core MAVEN version 1.605 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.tikalk.hudson.plugins:notification 1.10 - org.jenkins-ci.main:jenkins-test-harness 1.605 -...

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Test management is impacted by vulnerabilities in Eclipse Paho Java client library

Summary A vulnerability has been identified in Eclipse Paho Java client library, which is used in IBM Engineering Lifecycle Management - Engineering Test management Vulnerability Details CVEID:CVE-2019-11777 DESCRIPTION: In the Eclipse Paho Java client library version 1.2.0, when connecting to an...

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Test Management is impacted by vulnerabilities in commons-io library

Summary Vulnerabilities have been identified in commons-io library, which is used in IBM Engineering Lifecycle Management - Engineering Test Management Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The...