| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation. |
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates. |
| MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale. |
| IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable. |
| IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files. |
| NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.
A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines. |
| IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy. |
| Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. |
| Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158. |
| Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. |
| Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. |
| Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158. |
| Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158. |
| Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158. |
| Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158. |
| Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. |
| Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. |
| Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158. |
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. |
| Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. |
