PT-2026-108104

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The upload-processing pipeline in scripts/safe-extract.py fails to apply entry-count, nesting-depth, and total-uncompressed-byte limits when processing single-stream compressed formats such a...

PT-2026-107778

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA Authentication, Authorization, and Accounting integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific...

PT-2026-107953

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88 Description Incorrect permission assignment allows a local authenticated user to read or overwrite the inter-process communication IPC handles used between the TightVNC service and...

PT-2026-108279

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

PT-2026-107842

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine VM. This can happen when the SANnav server encounters an Out Of Memory OOM condition. The...

CVE-2026-16830: Improper Neutralization of Special Elements used in an SQL Command

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...

CVE-2026-14497: Improper Verification of Cryptographic Signature

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures...

CVE-2026-16177: Out-of-bounds Read

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...

PT-2026-107836

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...

CVE-2026-5049: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

PT-2026-108211

Name of the Vulnerable Software and Affected Versions Satel Netco Design versions prior to 2.1.7 Description An inefficient regular expression complexity issue exists where an authenticated user with Viewer privileges can submit crafted search input. This leads to excessive processing, which may...

CVE-2026-14521: Server-Side Request Forgery (SSRF)

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to...

PT-2026-108229

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of command arguments. Th...

PT-2026-107825

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

PT-2026-108225

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description An SQL injection flaw allows a remote authenticated attacker to modify data and cause a denial of service. SQL...

PT-2026-107955

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88 Description An integer underflow occurs in the trimTransparent function within WinCursorShapeUtils when a cursor shape with a width or height of zero is processed on the DXGI captur...

CVE-2026-16916: Protection Mechanism Failure

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure...

PT-2026-108115

Name of the Vulnerable Software and Affected Versions OpenStack Mistral versions prior to 23.0.0 Description The std.ssh proxied action passes a caller-supplied proxy command value directly to the paramiko.ProxyCommand function before attempting an SSH connection to a gateway or target host. An...

PT-2026-108176

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Stored cross-site scripting XSS exists in the Quick Search results grid. An unauthenticated attacker capable of influencing monitored database traffic can execute malicious scripts within t...

PT-2026-107931

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description An...