Skip to content
OpenAdvisories
Medium WID-SEC-2026-4413 5 CVEs

IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen

Published Nov 8, 2026 · Updated Nov 8, 2026 · de

Vendor: IBM Product: QRadar SIEM Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM (Log Source Management App) ausnutzen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.

Product

IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.

Vulnerabilities 5

  • High 7.5
    CVE-2026-112366

    Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

    Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtg…

    micromatch picomatch nodejs python-tensorboard Debian Ubuntu Azure Linux Wolfi
  • High 7.5
    CVE-2026-93687 Public exploit

    braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

    braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an u…

    micromatch braces langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi
  • High 7.5
    CVE-2026-93748

    http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

    http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same U…

    kornelski http-cache-semantics prism python-tensorboard Debian Ubuntu Azure Linux Wolfi
  • High 7.5
    CVE-2026-93749

    source-map-js through 1.2.1 Event Loop Denial of Service

    source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking …

    7rulnik source-map-js langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm
  • Medium 5.9
    CVE-2026-93750

    http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard

    http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other cl…

    kornelski http-cache-semantics python-tensorboard nodejs-nodemon Debian Ubuntu Azure Linux Wolfi

Revision history

  1. #1

    Initiale Fassung

References