CVE-2026-16911

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack buffer overflow...

CVE-2026-16877

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

CVE-2026-16911

CVE-2026-16911 affects IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 via a stack buffer overflow exploitable by a remote authenticated attacker (CVSS 8.8 HIGH, AV:N/AC:L/PR:L/UI:N). Exploitation details are not provided. IBM advisory: https://www.ibm.com/support/pages/node/7283858.

CVE-2026-16877 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

CVE-2026-16877

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain a stack-based buffer overflow exploitable by a remote authenticated attacker (CVSS 8.8 High), enabling arbitrary code execution with full confidentiality, integrity, and availability impact. IBM's support page (https://www.ibm.com/support/pages/node/72...

CVE-2026-16724 Power System Integer Overflow

IBM Virtualization Management Interface FW1110.00 through FW1110.30, FW1120.00 through FW1120.00, and FW1060.00 through FW1060.80 is affected by a vulnerability in the Virtualization Management Interface VMI. An attacker with authenticated administrator-level access can cause the VMI to crash. Th...

EUVD-2026-62754

IBM Virtualization Management Interface FW1110.00 through FW1110.30, FW1120.00 through FW1120.00, and FW1060.00 through FW1060.80 is affected by a vulnerability in the Virtualization Management Interface VMI. An attacker with authenticated administrator-level access can cause the VMI to crash. Th...

EUVD-2026-62743

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causin...

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

EUVD-2026-62730

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability,...

CVE-2026-16661 Power System Integer Overflow

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability,...

CVE-2026-19509

An improper input validation flaw in ajaxSet_wireless_network_configuration.jst in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to supply an abnormally large ssid_number value that is passed unvalidated to the RDK-B routing service. This causes memory corrup...

CVE-2026-19509 RDK WebUI DOS vulnerability

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

EUVD-2026-62716

Improper input validation in ajaxSetwirelessnetworkconfiguration.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated attacker to cause denial of service via a crafted ssidnumber parameter...

CVE-2026-16825

IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 are affected by an out-of-bounds write (CVSS 4.2 MEDIUM) exploitable by a remote authenticated attacker to obtain sensitive information and cause denial of service. No exploitation or remediation details are provided; refer to IBM advisory https://www.ibm.co...

EUVD-2026-62709

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write...

CVE-2026-76647 Leantime JSON-RPC API contains a missing authorization vulnerability

Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or a...

EUVD-2026-62706

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

CVE-2026-68560

Wekan (open-source kanban built with Meteor) is vulnerable to shell injection in models/fileValidation.js prior to version 9.75 . When an external antivirus scanner is configured, the uploaded file path is interpolated into the administrator-defined externalCommandLine at its {file} placeholder a...

CVE-2026-75619

Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RT...