DeutschShown in its original language — a full translation is planned for a future version.
IBM App Connect Enterprise: Mehrere Schwachstellen
view advisory published 2026-04-07
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um beliebigen Programmcode auszuführen.
01
describes (43)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-5119US | high8.2OT elevated | — | ||
A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT… | ||||
| CVE-2026-2436US | high8.2 | — | ||
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prem… | ||||
| CVE-2026-1961US | high8.8 | Exploit | ||
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the syste… | ||||
| CVE-2026-30922US | — | — | ||
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding… | ||||
| CVE-2026-4324US | — | — | ||
A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitra… | ||||
| CVE-2026-4271US | high7.5 | — | ||
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can… | ||||
| CVE-2026-3634US | medium6.5 | — | ||
A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sani… | ||||
| CVE-2026-3633US | medium6.5 | — | ||
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data… | ||||
| CVE-2026-3632US | medium5.5 | — | ||
A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing speci… | ||||
| CVE-2026-3731US | high7.5 | — | ||
A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the componen… | ||||
| CVE-2026-27138US | — | — | ||
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs… | ||||
| CVE-2026-27137US | — | — | ||
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these… | ||||
| CVE-2026-29063US | critical9.8 | — | ||
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeD… | ||||
| CVE-2026-29087US | —OT elevated | — | ||
@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware… | ||||
| CVE-2026-0540US | — | — | ||
DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization… | ||||
| CVE-2025-15599US | — | — | ||
DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing text… | ||||
| CVE-2026-0980US | high8.8 | — | ||
A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permiss… | ||||
| CVE-2026-27959US | — | Exploit | ||
Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting… | ||||
| CVE-2025-14831US | — | — | ||
A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious ce… | ||||
| CVE-2026-25518US | medium5.9 | — | ||
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In… | ||||
showing 20 of 43
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:14087 vom 2026-05-06external
- Red Hat Security Advisory RHSA-2026:17083 vom 2026-05-13external
- WID-SEC-W-2026-1007 - CSAF Versionself
- WID-SEC-2026-1007 - Portal Versionself
- IBM Security Bulletin 7268737 vom 2026-04-07external
- IBM Security Bulletin 7268738 vom 2026-04-07external
- IBM Security Bulletin 7268740 vom 2026-04-07external
- IBM Security Bulletin 7268741 vom 2026-04-07external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan