CVE-2025-36161
Medium · 5.9CVSS
5.9
EPSS
0.2%
Published
Nov 20, 2025
CISA due date
—
The record
IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|