Security Vulnerabilities
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVSS Score
6.8
EPSS Score
0.002
Published
2026-09-23
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.
CVSS Score
7.1
EPSS Score
0.002
Published
2026-09-23
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization.
CVSS Score
6.5
EPSS Score
0.002
Published
2026-09-23
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
CVSS Score
9.1
EPSS Score
0.004
Published
2026-09-23
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
CVSS Score
7.4
EPSS Score
0.002
Published
2026-09-23
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
CVSS Score
7.5
EPSS Score
0.006
Published
2026-09-23
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
CVSS Score
6.1
EPSS Score
0.004
Published
2026-09-23
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
CVSS Score
6.1
EPSS Score
0.004
Published
2026-09-23
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
CVSS Score
6.1
EPSS Score
0.004
Published
2026-09-23
A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.
This issue affects Apache Sling Security Bundle: before 1.3.2.
Users are recommended to upgrade to version 1.3.2, which fixes the issue.
CVSS Score
7.3
EPSS Score
0.002
Published
2026-09-23