CVE-2026-18235

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation...

CVE-2026-17248

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command...

CVE-2026-17276

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads...

CVE-2026-17248

CVE-2026-17248 affects IBM i 7.6/7.5/7.4/7.3 (5770-SS1) and is described in IBM’s Debug Server bulletin as allowing a remote authenticated attacker to cause a denial of service via improper neutralization of special elements in an OS command. The base CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C...

CVE-2026-18669 IBM i is Affected By A Privilege Escalation Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority...

CVE-2026-16863 IBM i is Affected By Out-of-Bounds Read Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...

CVE-2026-16860

CVE-2026-16860 affects IBM i releases 7.3–7.6 (5770-SS1). A remote authenticated attacker can execute arbitrary code due to an uncontrolled search path element. The vulnerability, tracked by IBM with a base CVSS v3.1 score of 9.9 (CRITICAL), is triggered by improper handling of search paths in th...

CVE-2026-16860 IBM i is Affected By Remote Code Execution Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element...

CVE-2026-18235

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation...

EUVD-2026-57358

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

CVE-2026-17095

IBM i versions 7.3–7.6 are affected by CVE-2026-17095 due to unsafe reflection, allowing remote authenticated attackers to bypass security restrictions. The IBM Security Bulletin lists additional Navigator for i vulnerabilities in the same family. Affected products: IBM i 7.3, 7.4, 7.5, 7.6. Impa...

CVE-2026-65937

CVE-2026-65937 affects WhatsUp Gold versions released before 2026.0.2. An authenticated attacker can bypass frontend controls and inject persistent script content via stored XSS vulnerabilities across the web UI. The CVSS3.1 score is 8.0 (HIGH) with adjacent attack vector, no privileges required,...

CVE-2026-65937 WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...

CVE-2026-73374

CVE-2026-73374 describes a stored XSS in Vulnerability-Lookup’s render_tag_badges Jinja filter. Values from containers.cna.references[].tags[] were interpolated into HTML badge markup and wrapped with MarkupSafe.Markup, bypassing Jinja escaping. An authenticated user with vulnerability:create/mod...

CVE-2025-41771 SQL injection

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

EUVD-2026-56980

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

PT-2026-71224

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...

PT-2026-71061

Name of the Vulnerable Software and Affected Versions Cal.com Cal.diy versions 2.1.1 through 6.2.0 Description A stored cross-site scripting issue exists in the BookingPageTagManager component. Authenticated event owners can inject arbitrary JavaScript by providing a malicious analytics tracking ...

PT-2026-71226

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An improper validation issue in the instancePostMigration function within lxd/instance post.go allows an authenticated attacker with can create instances permissions on a restricted project to...

CVE-2026-65981

A flaw was found in Coturn, an open-source implementation of TURN and STUN servers. An authenticated attacker who obtains a victim's MOBILITY-TICKET can exploit this vulnerability during a session resume. This allows the attacker to take over the victim's TURN Traversal Using Relays around NAT...