CVE-2026-76357

In Splunk SOAR on-premises versions below 8.6.0, the REST API fails to enforce role requirements and does not confine user-supplied file paths to the temporary directory, enabling an authenticated, role-less user to submit crafted paths and achieve arbitrary code execution (CVSS 7.6, HIGH). No in...

CVE-2026-76357 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer REST API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and do...

CVE-2026-76335 Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the editmanagerxml capability could write a malicious Splunk Web Manager Extensible Markup Language XML configuration. When the same user opens the affected Splunk Web Manag...

CVE-2026-76335

CVE-2026-76335 is a remote code execution vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . An authenticated user without the edit_manager_xml capability can write a malicious Splunk Web Manager XML configuration . When the same user opens the affected page, S...

CVE-2026-76328

A user with the "power" Splunk role can inject attacker-controlled SPL into a dashboard; when another user exports it to PDF, the injected SPL executes with that victim's permissions. Splunk Web fails to validate dashboard content during PDF export. Affected versions: below 10.4.1, 10.2.6, 10.0.9...

EUVD-2026-63102

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2025-36255

CVE-2025-36255 affects IBM System Storage DS8A00 (versions 10.1.3.0 through 10.11.35.0) and IBM DS8900F (versions 89.40.83.0 through 89.44.25.0). An authenticated user with low privileges can create a new user assigned privileged roles, due to improper privileged defined with unsafe actions . Thi...

CVE-2025-36255 DS8900F and DS8A00 Privilege Escalation

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions...

CVE-2025-36398

CVE-2025-36398 affects IBM System Storage DS8A00 (10.1.3.0–10.11.35.0) and IBM DS8900F (89.40.83.0–89.44.25.0). An authenticated user can read or modify another user's command history due to an externally controlled filename , resulting in low confidentiality and integrity impact (CVSS 3.1: 5.4 M...

CVE-2025-36398 DS8900F and DS8A00 Information Disclosure

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...

CVE-2026-75616

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

DEBIAN-CVE-2026-68555

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobilebegintransition in src/server/nsturnserver.c disarms each...

CVE-2026-54491

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost or isSafeUrl check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every...

CVE-2026-53549

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

CVE-2026-53545

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into...

CVE-2026-18544

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...

CVE-2026-18102

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking...

CVE-2026-63117

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. An authenticated Remote Desktop Protocol RDP client can trigger a denial of service by sending a specially crafted DVI ADPCM frame. By advertising specific nBlockAlign and nChannels values, a division-by-zero error...

CVE-2026-54491

Koel versions prior to 9.7.1 contain an authenticated SSRF: any low-privilege user can supply a URL that 302-redirects to internal addresses or cloud metadata IPs (e.g., 169.254.169.254), since isPublicHost()/isSafeUrl() checks are point-in-time with no IP pinning and per-hop redirect validation ...

CVE-2026-54491 Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost or isSafeUrl check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every...