Security Vulnerabilities
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
CVSS Score
6.4
EPSS Score
0.002
Published
2026-10-19
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-10-19
IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
CVSS Score
3.7
EPSS Score
0.002
Published
2026-10-19
IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.
CVSS Score
5.3
EPSS Score
0.003
Published
2026-10-19
IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.
CVSS Score
4.0
EPSS Score
0.002
Published
2026-10-19
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score
6.1
EPSS Score
0.002
Published
2026-10-19
IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.
CVSS Score
3.7
EPSS Score
0.001
Published
2026-10-19
IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.
CVSS Score
4.7
EPSS Score
0.001
Published
2026-10-19
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score
3.7
EPSS Score
0.001
Published
2026-10-19
IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-10-19