CVE-2026-17101

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication...

EUVD-2026-58399

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, pghero-fips, ruby3.3-rails, ruby3.2-rails, pghero...

CVE-2026-17099

CVE-2026-17099 affects IBM i 7.3–7.6 and could allow a remote attacker to obtain sensitive information due to improper authentication. The IBM advisory lists Navigator for i as the affected component with a base CVSS v3.1 score of 7.3 (Network, Low attack complexity, None privileges, Confidential...

EUVD-2026-58398

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication...

CVE-2026-17099 IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication...

CVE-2026-73418 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, jitsucom-jitsu...

CVE-2026-17074

This CVE affects IBM i versions 7.3–7.6. The issue allows a remote authenticated attacker to bypass security restrictions due to improper privilege management in DRDA/DDM handling. Affected component/area: privilege management during DRDA/DDM processing on IBM i. Root cause: improper privilege ma...

CVE-2026-72643

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

CVE-2026-17223

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-18164

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-17069

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-16908

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability...

CVE-2026-16867

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation...

CVE-2026-14525

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-16674

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path...

EUVD-2026-58389

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-17045

CVE-2026-17045 affects IBM i 7.6, 7.5, 7.4, and 7.3 due to improper session management that can allow a remote authenticated attacker to perform unauthorized operations and access sensitive information. The vulnerability is categorized under CWE-294 (Authentication Bypass by Capture-replay) with ...

CVE-2026-73655

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...