CVE Vulnerability Catalog

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 and the @instana/core component version 6.2.1 are vulnerable to prototype pollution through its configuration normalization API.

IBM WebSphere Application Server 9.0 and 8.5 traditional could allow a remote attacker to obtain sensitive information.

IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

Dompdf versions 3.15 and prior are vulnerable to a File Existence Oracle attack via manipulation of the CSS @font-face directive. An attacker can exploit the difference in behavior when referencing existing vs. non-existing local files (via file:// protocol) as an oracle to enumerate files on the server, even with CHROOT restrictions. This issue has been fixed in version 3.16.

In Dompdf versions 3.15 and prior, the validateLocalUri() method enforces CHROOT boundaries via a prefix check after path normalization. Because normalization strips the trailing directory separator, the check can be bypassed (e.g., /var/www also matches /var/www2). An attacker controlling part of the rendered HTML can read files outside the allowed directory. This issue has been fixed in version 3.16.

Litestar, an ASGI framework, prior to version 2.20.0 is vulnerable to HTML Injection which can be escalated to Cross Site Scripting (XSS) when a template engine is used with CSRF protection and the CSRF cookie contents are not automatically escaped by the template engine if configured per documentation recommendations.

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

IBM WebSphere Application Server versions 9.0 and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Artica Proxy before version 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controlled session identifier and wait for a victim to authenticate through fw.login.php, after which the attacker gains a fully authenticated administrative session on port 9000.

PhpSpreadsheet in multiple versions (4.0.0-5.8.0, 3.3.0-3.10.6, 2.2.0-2.4.6, 2.0.0-2.1.17, and all up to 1.30.5) contains a vulnerability in the Gnumeric reader. The reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service.

In pglogical, when applying replicated changes for a row with missing columns, the table's default expressions are evaluated on the subscriber. The apply worker runs with PostgreSQL superuser privileges, so functions invoked by default expressions also run with those privileges. A publisher can use this path to escalate to superuser on the subscriber.