CVE Notifier

CVE-2026-11537 CWE-650 4.3

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

cve.org IBM:WebSphere · Application · Server 1 hari lalu

CVE-2026-84400 CWE-306 3.1

CareCam CM2507 Missing Authentication for Critical Function

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state condition…

cve.org CareCam:HMT.CM2507 · Firmware 1 hari lalu

CVE-2026-54148 CWE-294 8.1

http4k: `DigestAuthProvider.verify` did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest r…

cve.org http4k:http4k 1 hari lalu

CVE-2026-11381 CWE-122 8.8

IBM MQ for HPE NonStop is vulnerable to a denial of service issue

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.

cve.org IBM:MQ · for · HPE 1 hari lalu

CVE-2026-11378 CWE-190 8.8

IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.

cve.org IBM:MQ 1 hari lalu

CVE-2025-61682 CWE-79 8.6

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribut…

cve.org SemanticMediaWiki:SemanticMediaWiki 1 hari lalu

CVE-2026-11375 CWE-122 8.8

IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.

cve.org IBM:MQ 1 hari lalu

CVE-2026-77568 CWE-200 4.2

Mojolicious: CSRF tokens are vulnerable to BREACH attacks

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is …

cve.org mojolicious:mojo 1 hari lalu

CVE-2026-10858 CWE-122 9.9

IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages…

cve.org IBM:MQ · for · HPE 1 hari lalu

CVE-2026-84398 CWE-258 7.5

CareCam CM2507 Empty Password in Configuration File

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and ob…

cve.org CareCam:HMT.CM2507 · Firmware 1 hari lalu

CVE-2026-10853 CWE-470 7.5

IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.

cve.org IBM:MQ 1 hari lalu

CVE-2026-68914 CWE-400 N/A

Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data

Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. An attacker wh…

cve.org mojolicious:mojo 1 hari lalu