CVE-2026-1037
published 2026-09-18CVE-2026-1037: IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.20%
8.9th percentile
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | common_licensing | — | — |
| ibm | common_licensing | — | — |
| ibm | common_licensing | — | — |
| ibm | common_licensing | — | — |
| ibm | common_licensing | — | — |
| ibm | common_licensing | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting.
ghsa_unreviewed·2026-09-18
CVE-2026-1037 [MEDIUM] CWE-79 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting.
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Red Hat
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
vendor_redhat·2026-07-21·CVSS 9.8
CVE-2026-16410 [CRITICAL] CWE-1037 firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
JIT miscompilation in the JavaScript Engine: JIT component
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/firefox-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/thunderbird-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 10) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not aff
Red Hat
kernel: arm64: errata: Mitigate TLBI errata on various Arm CPUs
vendor_redhat·2026-07-01·CVSS 9.1
CVE-2026-53354 [CRITICAL] CWE-1037 kernel: arm64: errata: Mitigate TLBI errata on various Arm CPUs
kernel: arm64: errata: Mitigate TLBI errata on various Arm CPUs
A flaw was found in the Linux kernel, affecting systems running on certain Arm processors. This vulnerability involves an issue with how the system handles Translation Lookaside Buffer Invalidation (TLBI) operations. Specifically, a sequence of operations intended to invalidate memory translations may complete before all related memory writes are fully observed across the system. This could lead to inconsistencies in memory access, although the TLB entries themselves are correctly invalidated.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not a
Red Hat
kernel: x86/fred: Correct speculative safety in fred_extint()
vendor_redhat·2026-03-25·CVSS 3.3
CVE-2026-23354 [MEDIUM] CWE-1037 kernel: x86/fred: Correct speculative safety in fred_extint()
kernel: x86/fred: Correct speculative safety in fred_extint()
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no use if the result gets spilled to the stack, as
it makes the believed safe-under-speculation value subject to memory
predictions.
For all practical purposes, this means array_index_nospec() must be used in
the expression that accesses the array.
As the code currently stands, it's the wrong side of irqentry_enter(), and
'index' is put into %ebp across the function call.
Remove the index variable and reposition array_index_nospec(), so it's
calculated immediately before the array access.
A flaw was found in the Linux kernel. This vulnerability affects the handling of speculative exe
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-18
Published