Skip to content
OpenAdvisories
High WID-SEC-2026-0526 4 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen

Published Feb 25, 2026 · Updated May 7, 2026 · Revision 6 · de-DE

Vendor: IBM Product: App Connect Enterprise Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Daten zu manipulieren, und um einen Denial of Service Angriff durchzuführen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 4

  • Critical 9.8
    CVE-2025-61140

    JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

    The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

    jsonpath npm
  • Critical 9.2
    CVE-2026-25547

    Uncontrolled Resource Consumption in @isaacs/brace-expansion

    @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern con…

    isaacs brace-expansion renovate lerna Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-25128

    fast-xml-parser has RangeError DoS Numeric Entities Bug

    fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-pa…

    NaturalIntelligence fast-xml-parser langfuse-3-worker renovate Ubuntu Wolfi npm
  • Low 2.7
    CVE-2026-24001

    jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

    jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\r`, `\u2028`, or `\u2029` can cause the `parsePatch` method to en…

    kpdecker jsdiff langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm

Revision history

  1. #6

    Neue Updates von IBM aufgenommen

  2. #5

    Neue Updates von IBM aufgenommen

  3. #4

    Neue Updates von IBM aufgenommen

  4. #3

    Neue Updates von IBM aufgenommen

  5. #2

    Neue Updates von IBM aufgenommen

  6. #1

    Initiale Fassung

References