CVE-2026-72841 luci-app-openvpn Path Traversal RCE via instance_name2

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...

CVE-2026-73039

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...

CVE-2026-73039 streama Insecure Direct Object Reference via ViewingStatusController

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...

CVE-2026-73664 FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module

FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorizedkeys for the asterisk system user without reliably enforcing backup-only...

CVE-2026-73662

CVE-2026-73662 affects FreePBX Music on Hold module (versions 17.0.1–17.0.7). The vulnerability arises from validateCustomConfiguration() in Music.class.php allowing dangerous command-line options to mpg123 and other allowed players, enabling an authenticated administrator to write files, open co...

CVE-2026-73662 Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73660 FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

CVE-2026-73660

Summary: CVE-2026-73660 affects FreePBX’s Text-To-Speech (TTS) module prior to versions 16.0.6 and 17.0.5.4. An authenticated administrator can save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, and used as an AGI argument to reach a raw shell-comman...

CVE-2026-73660

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

EUVD-2026-58483

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

CVE-2026-73660 FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

CVE-2026-18671

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary denial of service...

CVE-2026-18741

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

CVE-2026-18715

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities...

CVE-2026-17071

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal...

CVE-2026-17088

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

CVE-2026-18715 IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities...

CVE-2026-18715

CVE-2026-18715 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. The issue arises from improper processing of XML external entities, allowing a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS v3.1 base score of 6.5 (Network, Low attack complexity, Privileg...

EUVD-2026-58474

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities...

CVE-2026-18671 IBM i is Affected By Multiple Vulnerabilities in NetServer

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary denial of service...