CVE-2026-95695 is a high-severity vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It involves incorrect authorization that could allow a remote attacker to bypass security restrictions without authentication. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.
CVE-2026-95696 is a medium severity vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It involves uncontrolled resource consumption caused by an uncaught exception, which could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.
CVE-2026-101294 is a high-severity vulnerability in IBM WebSphere Application Server - Liberty and IBM WebSphere Application Server versions 8.5 and 9.0. It involves a missing cryptographic step that allows a remote attacker to bypass cryptographic signature verification due to improper verification of the cryptographic signature. This flaw affects versions 17.0.0.3 through 26.0.0.10 of WebSphere Application Server - Liberty and versions 8.5 and 9.0 of WebSphere Application Server. The vulnerability has a CVSS 3.1 score of 8.7, indicating a high impact on confidentiality and integrity without requiring privileges or user interaction. No patch or remediation information is provided in the available data.
CVE-2026-105442 is a high-severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty editions from 17.0.0.3 through 26.0.0.10. It involves insecure deserialization of untrusted data in the messaging service, which could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 suffer from insufficient isolation between servers sharing the same installation. This improper access control vulnerability can lead to high impact on confidentiality and integrity without user interaction. The vulnerability is tracked as CVE-2026-105443 and has a CVSS 3.1 score of 8.2, indicating high severity.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are affected by a privilege escalation vulnerability when the restConnector-2.0 feature is enabled. This vulnerability involves incorrect authorization, potentially allowing users with limited privileges to escalate their access rights. The CVSS v3.1 base score is 5.4, indicating a medium severity issue.
CVE-2026-14532 is an integer overflow or wraparound vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. A user with Reader role privileges could exploit this flaw to obtain version information, which leads to an uncaught exception. The vulnerability has a medium severity rating with a CVSS score of 4.3. No information about available patches or vendor advisories is provided.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 contain an information disclosure vulnerability (CWE-209) that allows an authenticated attacker to obtain sensitive information when the restConnector-2.0 feature is enabled. The vulnerability involves generation of error messages that expose sensitive data. The CVSS 3.1 base score is 6.5, indicating a medium severity issue.
CVE-2026-77816 is a vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. It involves improper certificate validation in the administrative client, which could allow a man-in-the-middle attacker to obtain sensitive information. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-79715 is a path traversal vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. It allows a local attacker to use a specially crafted application archive to write files outside the intended directory. This could lead to unauthorized file modification on the system.
A denial of service vulnerability exists in Microsoft.AspNetCore.SignalR.Protocols.MessagePack where the MessagePack protocol can consume excessive memory when deserializing deeply nested attacker-controlled arrays. This vulnerability affects multiple versions of the package across Windows, Linux, and macOS platforms. The issue is identified as CWE-1325 and has a CVSS 3.1 score of 5.3 (medium severity). Patched versions have been released to address this vulnerability.
CVE-2026-85473 is a vulnerability in the Auth0 java-jwt library where parsing JWT tokens with out-of-range timestamp claims (exp, nbf, iat) can cause thread termination. This occurs before signature verification and may degrade service availability if exploited repeatedly.
CVE-2026-78633 is a vulnerability in the Okta RADIUS Agent where the software fails to validate the length of a sub-attribute in a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to enter an infinite loop, exhausting worker threads and resulting in denial of new RADIUS authentication requests. This affects versions from 2.17.5 up to but not including 2.28.0. The vulnerability has a CVSS score of 6.5, indicating medium severity, with no impact on confidentiality or integrity but causing availability disruption.
CVE-2026-78632 is a medium severity vulnerability in the Okta RADIUS Agent Windows installer. It incorrectly assigns write permissions to broad security principals (NT SERVICE\ALL SERVICES and CREATOR OWNER) on directories containing sensitive data such as the agent configuration, AES encryption key, and logs. This misconfiguration allows any local service account on the host to read the AES encryption key and the encrypted Okta API token, potentially exposing critical credentials.
CVE-2026-107371 is a medium severity vulnerability in the Auth0 auth0.js library where the authorize() method does not properly validate the auth_time claim in the ID token against the requested maxAge parameter. This can cause applications to accept ID tokens representing authentication events older than intended, potentially weakening session expiration controls.
CVE-2026-107370 is a vulnerability in the Auth0 auth0-lock library where, under certain conditions involving Active Directory usernames formatted as domains without a local part, authentication requests use the GET method instead of POST. This causes sensitive user form data to be included in the URL query string, potentially exposing it in logs or browser history. The issue affects versions from 10.9.0 up to but not including 13.2.1, and from 14.0.0 up to but not including 15.0.2. The CVSS score is 5.3, indicating a medium severity impact primarily due to confidentiality concerns. There is no information provided about patches or vendor advisories. No known exploits are reported in the wild.
CVE-2026-107369 is an open redirect vulnerability in the Auth0 nextjs-auth0 SDK. The SDK attempts to validate the returnTo parameter as a same-origin URL but reconstructs it in a way that browsers may interpret as an absolute or scheme-relative URL, allowing redirection to unintended external domains. This can lead to potential phishing or redirection attacks after authentication.
CVE-2026-78628 is a vulnerability in the Okta Credential Provider for Windows where improper input validation of a serialized credential buffer can lead to process termination or out-of-bounds memory access. This may cause disclosure of adjacent process memory into local system logs. The issue affects versions prior to 1.4.6.0.
CVE-2026-63171 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can inject malicious scripts by submitting a specially crafted forum category description containing a double-quote character. This input breaks out of an HTML input value attribute due to the HTMLPurifier configuration preserving double-quotes, allowing script execution in users' browsers who view the affected forum category.
CVE-2026-63169 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can post messages containing attacker-controlled iframes via the messenger's HTMLPurifier SafeIframe branch. These malicious iframes are stored and rendered to other channel members, enabling zero-click drive-by downloads and execution of framed JavaScript in recipients' browsers.