🚨 CVE-2026-14979
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.
🎖@cveNotify
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.
🎖@cveNotify
Ibm
Security Bulletin: IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
XML Entity Expansion vulnerability has been identified in IBM Engineering Lifecycle Management - Jazz Foundation.
🚨 CVE-2026-13442
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.
🎖@cveNotify
Ibm
Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due…
Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol (MCP) server configuration. An attacker could…
🚨 CVE-2026-13463
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.
🎖@cveNotify
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.
🎖@cveNotify
Ibm
Security Bulletin: Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability [CVE-2026-13463]
Vulnerabilities was addressed in IBM Cloud Pak System version 2.3.5.1.
🚨 CVE-2026-14446
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
🎖@cveNotify
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server is affected by a privilege escalation (CVE-2026-14446)
IBM WebSphere Application Server is affected by a privilege escalation vulnerability.
🚨 CVE-2026-14512
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
🎖@cveNotify
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information…
IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information.
🚨 CVE-2026-14515
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.
🎖@cveNotify
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVE…
IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515).
🚨 CVE-2026-14528
IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.
🎖@cveNotify
IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information…
IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information.
🚨 CVE-2026-14893
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
🎖@cveNotify
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
🎖@cveNotify
Ibm
Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.321
🚨 CVE-2026-14958
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
🎖@cveNotify
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
🎖@cveNotify
Ibm
Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex
Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.16
🚨 CVE-2026-14959
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.
🎖@cveNotify
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.
🎖@cveNotify
Ibm
Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex
Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.16
🚨 CVE-2026-14973
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.
🎖@cveNotify
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.
🎖@cveNotify
Ibm
Security Bulletin: Multiple vulnerabilities in IBM Desktop App
Multiple vulnerabilities were addressed in IBM Aspera Desktop App v1.1.0.
🚨 CVE-2026-14974
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
🎖@cveNotify
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVE…
IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515).
🚨 CVE-2026-14976
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
🎖@cveNotify
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability…
IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled.
🚨 CVE-2026-14981
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
🎖@cveNotify
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled.
🚨 CVE-2026-14996
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
🎖@cveNotify
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
🎖@cveNotify
Ibm
Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex
Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.16
🚨 CVE-2026-15057
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
🎖@cveNotify
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability (CVE-2026-15057)
IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability due to an out-of-bounds write when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled.
🚨 CVE-2026-15064
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
🎖@cveNotify
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled.
🚨 CVE-2026-15280
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
🎖@cveNotify
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability…
IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled.
🚨 CVE-2026-15328
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling.
🎖@cveNotify
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling.
🎖@cveNotify
Ibm
Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled.
🚨 CVE-2026-16581
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
🎖@cveNotify
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
🎖@cveNotify
🚨 CVE-2026-49447
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
🎖@cveNotify
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
🎖@cveNotify
GitHub
[release] v0.22.19 · azukaar/Cosmos-Server@59c561d
☁️ The Most Secure and Easy Selfhosted Home Server. Take control of your data and privacy without sacrificing security and stability (Authentication, anti-DDOS, anti-bot) - [release] v0.22.19 · azukaar/Cosmos-Server@59c561d