CVE-2025-36364Medium· 6.2▾ SunlitIBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system.
devops_plan >= 3.0.0, < 3.0.6Upgrade past the affected range:
devops_plan 3.0.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4096Medium· 6.5IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers
CVE-2025-36363Medium· 5.9IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
CVE-2024-22349Medium· 4.0IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0
CVE-2024-22348Medium· 5.3IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0
CVE-2024-22347Medium· 5.9IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0
CVE-2026-35145Low· 3.1HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability