Skip to content
OpenAdvisories
High WID-SEC-2026-1434 8 CVEs

IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

Published May 7, 2026 · Updated Nov 9, 2026 · Revision 4 · de

Vendor: IBM Vendor: Red Hat Product: App Connect Enterprise Product: Concert Product: Enterprise Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-33937 Public exploit

    Handlebars.js has JavaScript Injection via AST Type Confusion

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 8.3
    CVE-2026-33941

    Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 8.1
    CVE-2026-33938

    Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that a…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 8.1
    CVE-2026-33940

    Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `unde…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-33939

    Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProp…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-39892

    cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer o…

    pyca cryptography open-webui airflow-3 Debian Alpine Wolfi PyPI
  • Medium 5.3
    CVE-2026-40087

    LangChain has incomplete f-string validation in prompt templates

    LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatte…

    langchain-ai langchain open-webui langchain-core Wolfi PyPI
  • Low 1.7
    CVE-2026-34073

    cryptography has incomplete DNS name constraint enforcement on peer names

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each val…

    pyca cryptography airflow-3 kserve-storage-controller Debian Alpine Wolfi PyPI

Revision history

  1. #4

    Neue Updates von IBM aufgenommen

  2. #3

    Neue Updates von IBM aufgenommen

  3. #2

    Neue Updates von Red Hat aufgenommen

  4. #1

    Initiale Fassung

References