Threats affecting pkg:generic/mosquitto

A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java of the component Participant Details Endpoint. Performing a manipulation results in insufficient session timeout value. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

A malicious file identified by the SHA-256 hash ed968e840d10d2d313a870bc131a4e2c311d7ad09bdf32b3418147221f51a6e2 was observed by OffSeq Mirage honeypot sensors during attacker activity between November 13 and 14, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Brazil. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.

IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability is identified as CWE-918 and has a CVSS 3.1 base score of 6.4, indicating a medium severity level. Exploitation requires authentication and does not involve user interaction. No public exploits or known active exploitation have been reported. The affected product is not a cloud service, and no patch or remediation details are currently provided.

IBM Security QRadar EDR versions 3.12.0 through 3.12.26 contain an improper access control vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but has a medium severity rating based on its potential to disclose confidential data.

IBM Security QRadar EDR versions 3.12.0 through 3.12.26 contain a vulnerability where improper rate limiting on TOTP verification allows a remote authenticated attacker to bypass security restrictions. This flaw could enable attackers with valid credentials to perform excessive authentication attempts without being blocked, potentially compromising confidentiality and integrity of the system.

CVE-2026-109158 is a vulnerability in IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands where sensitive information may be logged within error messages by the AI Agent. This exposure could allow unauthorized parties to access sensitive environment details through log files.

The rush-mfa npm package contains malicious code that compromises any computer on which it is installed or running. Systems affected by this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by it.

CVE-2026-115788 is a high-severity vulnerability in IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands. It involves improper output neutralization for logs (CWE-117), which can lead to log forging when creating a resource. The vulnerability affects multiple versions of the product series 12.x and 13.x. No public exploits or patches are currently documented.

CVE-2025-43874 is a high-severity OS Command Injection vulnerability in Johnson Controls iSTAR Ultra series devices. It affects multiple product variants including iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 versions prior to 6.9.2.CU02. The flaw arises from improper neutralization of special elements used in OS commands, potentially allowing an attacker with low privileges to execute arbitrary OS commands. A fix is available in version 6.9.2.CU02.

CVE-2026-114468 is a vulnerability in IBM App Connect Operator and App Connect Enterprise Certified Containers Operands where hard-coded credentials allow an attacker with the ability to run HTTP calls inside the container to make administrative calls to a running IntegrationRuntime. This could lead to unauthorized modification or disruption of the service.

CVE-2025-53700 is a medium severity vulnerability in Johnson Controls iSTAR Ultra and related products that involves insecure storage of sensitive information. This flaw affects multiple iSTAR Ultra variants prior to version 6.9.2.CU02 and allows file manipulation as described by CAPEC-15. The vulnerability has been fixed in version 6.9.2.CU02.

IBM Bob version 2.0.3 has a vulnerability where unauthorized extensions can retrieve session tokens through the authentication provider API. These tokens are exposed in the account identifier field during account enumeration without explicit user consent. This exposure could allow malicious extensions to access sensitive session information. The vulnerability has a low severity rating and does not appear to have known exploits in the wild.

CVE-2025-53699 is a high-severity vulnerability in Johnson Controls iSTAR Ultra series devices caused by a missing protection mechanism for an alternate hardware interface. This flaw affects multiple iSTAR Ultra product variants prior to version 6.9.2.CU02 and allows functionality bypass as described by CAPEC-554. The vulnerability has been fixed in version 6.9.2.CU02.

IBM webMethods Integration Server versions 10.15 through 10.15_Core_Fix2 and 11.1 through 11.1_Core_Fix11 contain a vulnerability that allows remote attackers to access sensitive server-side environment variables and Java runtime details. This exposure could lead to unauthorized disclosure of critical information.

CVE-2025-53698 is a vulnerability in Johnson Controls iSTAR Ultra and iSTAR Ultra SE devices prior to version 6.9.2.CU02. It involves a missing protection mechanism for an alternate hardware interface, which can lead to functionality bypass as described by CAPEC-554. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.0. A fix is available in version 6.9.2.CU02.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a stack-based buffer overflow vulnerability in the QFileSvr.400 file system due to improper bounds checking. A local authenticated attacker could trigger undefined behavior by sending a crafted command. The vulnerability has a CVSS score of 5.3, indicating medium severity.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system. This may enable network enumeration or assist in launching further attacks. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation information is provided in the available data.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain an improper access control vulnerability in the bulk import functionality. A remote authenticated attacker with team-scoped admin.import permission can manipulate the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants. This is achieved by sending a crafted POST request to the /v1/import endpoint with conflict_strategy=update, causing subsequent AI gateway calls to be redirected to an attacker-controlled host.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a cross-site scripting (XSS) vulnerability. This flaw allows a privileged user to inject arbitrary JavaScript code into the web interface, potentially altering its intended functionality and leading to the disclosure of credentials within a trusted session.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 contain an improper authentication vulnerability. The X-Upstream-Authorization HTTP header can override the gateway-managed upstream credentials for OAuth, bearer, and basic authentication methods. This flaw allows an authenticated user to make upstream requests using different credentials, potentially bypassing per-user permissions and audit attribution controls.