CVE-2026-75095

HighCVSS 7.5/10Last modified Oct 13, 2026

Description

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	Aspera Enterprise WebApps	>= 1.0.0, <= 1.0.6

References

https://www.ibm.com/support/pages/node/7291755

Timeline

Published: Oct 12, 2026
Last modified: Oct 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-750987.5The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg'CVE-2026-750995.3Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are CVE-2026-75106.3A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component CVE-2026-751016.5An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read CVE-2026-751038.8Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any CVE-2026-751045.5Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside th CVE-2026-751057.5phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_CVE-2026-751069.1OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticat CVE-2026-751075.4Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select CVE-2026-751085.4Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user CVE-2026-751097.1Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers c CVE-2026-75117.5PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a fo