WS-2019-0461

versions v1.0.0--v1.0.4 of only-test-not-install contain malicious code. The package deletes the folder /test from the system as a postinstall script...

PT-2026-41166

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.3.0 through 0.8.22 Description The run tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, allowing it to run without user approval. Because cargo test compiles and executes arbitrary...

Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of Eclipse Jetty

Summary Due to use of Eclipse Jetty, DevOps Test Performance and Rational Performance Tester contain potential input validation, information exposure, integer overflow, memory allocation, HTTP parsing, and URI authority validation vulnerabilities. Vulnerability Details CVEID:CVE-2022-2047...

CVE-2026-42203

A flaw was found in LiteLLM, an AI Gateway. An authenticated user could exploit this by sending a crafted prompt template to the POST /prompts/test endpoint. The endpoint rendered user-supplied prompt templates without proper sandboxing. This could lead to arbitrary code execution within the...

CVE-2026-43685

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5...

CVE-2026-43685

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5...

CVE-2026-43685

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5...

CVE-2026-43685

A Remote Code Execution vulnerability exists in Claris FileMaker Cloud (versions prior to 2.22.0.5 ) due to improper neutralization of special elements in the External ODBC Data Source connection test feature. An attacker with Admin Console privileges can inject arbitrary operating system command...

org.pidster:embed-apache-tomcat-core (0.2), org.pidster:embed-apache-tomcat-test (0.2) potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat (8.0.0-rc5)

org.apache.tomcat:tomcat MAVEN version 8.0.0-rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.pidster:embed-apache-tomcat-core 0.2 - org.pidster:embed-apache-tomcat-test 0.2 Source cves:...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.pidster:embed-apache-tomcat-core (0.1-alpha), org.pidster:embed-apache-tomcat-test (0.1-alpha) potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat (8.0.0-rc3)

org.apache.tomcat:tomcat MAVEN version 8.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.pidster:embed-apache-tomcat-core 0.1-alpha - org.pidster:embed-apache-tomcat-test 0.1-alpha Source cves...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

com.github.jsimone:webapp-runner (8.5.9.0), com.github.obase:obase-test (>=0.5.0, <=0.7.0) +7 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.5.9)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 8.5.9.0 - com.github.obase:obase-test =0.5.0...

ch.ralscha:embeddedtc (0.0.9), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.28) +3 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (7.0.28)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.ralscha:embeddedtc 0.0.9 - org.apache.tomcat.embed:tomcat-embed-jasper...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (8.5.21), org.apache.tomcat.embed:tomcat-embed-websocket (8.5.21) +3 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.21)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 8.5.21 -...

org.pidster:embed-apache-tomcat-core (0.1-alpha), org.pidster:embed-apache-tomcat-test (0.1-alpha) potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat (8.0.0-rc3)

org.apache.tomcat:tomcat MAVEN version 8.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.pidster:embed-apache-tomcat-core 0.1-alpha - org.pidster:embed-apache-tomcat-test 0.1-alpha Source cves...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of netty-codec-http

Summary Due to use of netty-codec-http, DevOps Test Performance and Rational Performance Tester contain a potential CRLF injection vulnerability. Vulnerability Details CVEID:CVE-2026-41417 DESCRIPTION: Netty allows request-line validation to be bypassed when a DefaultHttpRequest or...