Latest critical severity vulnerabilities for "ibm watsonx.data intelligence"

Where

AND

Sort:

Versions

5.2.0, 5.2.1, 5.3.0, 5.3.1

5.2.0, 5.2.1, 5.2.2, 5.3.0

5.2.2, 5.3.0, 5.3.1, 5.3.1-patch-1

npm/node-forgeForge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Risk 47

Severity

9.1

EPSS

0.02%

First published (updated )

CVE-2026-33896

pip/onnxONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

Risk 71

Severity

9.1

First published (updated )

CVE-2026-28500

npm/undiciundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Risk 86

Severity

9.8

First published (updated )

CVE-2026-1525

npm/fast-xml-parserfast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Risk 43

Severity

9.3

EPSS

0.04%

First published (updated )

CVE-2026-25896

Apache Commons TextCode Injection

Risk 86

Severity

9.8

First published (updated )

CVE-2025-46295

Eclipse JerseyRace Condition allows Bypass of Trust Restrictions

Risk 61

Severity

9.4

First published (updated )

CVE-2025-12383

redhat JBoss Enterprise Application PlatformUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Risk 76

Severity

9.6

First published (updated )

CVE-2025-12543

sha.js sha.jsMissing type checks leading to hash rewind and passing on crafted data

Risk 44

Severity

9.1

EPSS

0.06%

First published (updated )

CVE-2025-9288

cipher-base cipher-baseMissing type checks leading to hash rewind and passing on crafted data

Risk 44

Severity

9.1

EPSS

0.19%

First published (updated )

CVE-2025-9287

npm/form-dataUsage of unsafe random function in form-data for choosing boundary

Risk 46

Severity

9.4

EPSS

0.02%

First published (updated )

CVE-2025-7783

Node.js pbkdf2On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

Risk 55

Severity

9.1

EPSS

0.10%

First published (updated )

CVE-2025-6547

pbkdf2 pbkdf2pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

Risk 57

Severity

9.1

EPSS

0.09%

First published (updated )

CVE-2025-6545

maven/net.sourceforge.pmd:pmd-uiPMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

Risk 59

Severity

9.3

EPSS

0.04%

First published (updated )

CVE-2025-23215

npm/dompurifyDOMPurify vulnerable to tampering by prototype polution

Risk 62

Severity

9.8

EPSS

0.07%

First published (updated )

CVE-2024-48910

npm/dompurifyDOMPurify nesting-based mXSS

Risk 87

Severity

First published (updated )

CVE-2024-47875

Snakeyaml Project SnakeyamlRemote Code execution in SnakeYAML

Risk 93

Severity

9.8

First published (updated )

CVE-2022-1471

Juniper Security Threat Response ManagerApache commons_text(CVE-2022-42889) and commons_configuration (CVE-2022-33980) vulnerability

Risk 99

Severity

9.8

Exploited

First published (updated )

CVE-2022-42889

Trending

Versions

npm/node-forgeForge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

pip/onnxONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

npm/undiciundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

npm/fast-xml-parserfast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Apache Commons TextCode Injection

Don't miss critical vulnerabilities

Eclipse JerseyRace Condition allows Bypass of Trust Restrictions

redhat JBoss Enterprise Application PlatformUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

sha.js sha.jsMissing type checks leading to hash rewind and passing on crafted data

cipher-base cipher-baseMissing type checks leading to hash rewind and passing on crafted data

npm/form-dataUsage of unsafe random function in form-data for choosing boundary

Don't miss critical vulnerabilities

Node.js pbkdf2On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

pbkdf2 pbkdf2pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

maven/net.sourceforge.pmd:pmd-uiPMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

npm/dompurifyDOMPurify vulnerable to tampering by prototype polution

npm/dompurifyDOMPurify nesting-based mXSS

Don't miss critical vulnerabilities

Snakeyaml Project SnakeyamlRemote Code execution in SnakeYAML

Juniper Security Threat Response ManagerApache commons_text(CVE-2022-42889) and commons_configuration (CVE-2022-33980) vulnerability

Company

Resources

Contact