CVE-2026-16906

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command...

CVE-2026-16860

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element...

CVE-2026-16904

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

EUVD-2026-57397

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder...

CVE-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

CVE-2026-16627

GitLab CE/EE versions 19.2 before 19.2.2 are affected by a privilege escalation vulnerability caused by improper sanitization of HTML content rendered in a CI job modal. An authenticated user with developer-role permissions can exploit this under certain conditions to escalate privileges. The iss...

CVE-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

CVE-2026-18244

GitLab EE remediation: CVE-2026-18244 affects all GitLab EE versions 17.7–before 19.0.6, 19.1–before 19.1.4, and 19.2–before 19.2.2, where an authenticated user could view restricted group settings due to improper authorization checks on a group settings page. The CVSS 3.1 base score is 4.3 (Medi...

EUVD-2026-57391

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

CVE-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

Server-side Request Forgery (SSRF)

Overview prowler is a Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI,...

Cleartext Storage of Sensitive Information

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the Variable deserialization. An attacker can access sensiti...

Insertion of Sensitive Information Into Sent Data

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the UI display. An attacker can view sensitive variable values by accessing deeply nested dat...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the BaseXCom.deserializevalue. An attacker can execute arbitrary code on the API server by submitting specially crafted JSON string literals to the GET /api/v2/.../xcomEntries/key?deserialize=true...

CVE-2026-16907

IBM i bulletin CVE-2026-16907 affects IBM i 7.3–7.6 (5770-SS1) and describes a remote authenticated code execution vulnerability in the Debug Server caused by improper bounds checking. Affected releases: 7.6, 7.5, 7.4, and 7.3. Impact per the CVSS: Confidentiality Low, Integrity High, Availabilit...

CVE-2026-16907 IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...

EUVD-2026-57387

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...

EUVD-2026-57386

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command...

CVE-2026-17248

CVE-2026-17248 affects IBM i 7.6/7.5/7.4/7.3 (5770-SS1) and is described in IBM’s Debug Server bulletin as allowing a remote authenticated attacker to cause a denial of service via improper neutralization of special elements in an OS command. The base CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C...

CVE-2026-17248 IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command...