EUVD-2026-77456

LangBot's plugin runtime pip package langbotplugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugindebugkey, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

CVE-2026-16826

CVE-2026-16826 affects the Debug Server component of IBM i versions 7.3, 7.4, 7.5, and 7.6. The root cause is CWE-78 (OS Command Injection) : improper neutralization of special elements used in an OS command, allowing a local attacker with low privileges to execute arbitrary commands . NVD scores...

CVE-2026-16826 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17259 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow...

CVE-2026-17259

CVE-2026-17259 affects the Debug Server component of IBM i versions 7.3 through 7.6. A remote authenticated attacker can trigger a stack-based buffer overflow (CWE-121), resulting in a denial of service with low availability impact and no impact on confidentiality or integrity. The attack vector ...

CVE-2026-17270 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow...

CVE-2026-17270

CVE-2026-17270 is one of eight vulnerabilities in the IBM i Debug Server component affecting versions 7.3, 7.4, 7.5, and 7.6 . The root cause is a stack-based buffer overflow (CWE-121) that allows a local attacker to cause a denial of service . The assigned CVSS v3.1 score is 4.3 (Medium) with a ...

CVE-2026-17273

CVE-2026-17273 affects the Debug Server component in IBM i versions 7.3, 7.4, 7.5, and 7.6. A remote authenticated attacker with low privileges can trigger a NULL pointer dereference (CWE-476), resulting in a denial of service with no impact on confidentiality or integrity. The IBM-assigned CVSS ...

CVE-2026-17273 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference...

CVE-2026-17274

CVE-2026-17274 affects the Debug Server component of IBM i versions 7.6, 7.5, 7.4, and 7.3. The vulnerability stems from predictable server seeds (CWE-330: Use of Insufficiently Random Values), allowing a remote authenticated attacker to bypass security restrictions with low complexity over the n...

CVE-2026-17274 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds...

CVE-2026-17499

CVE-2026-17499 is an OS command injection (CWE-78) in the Debug Server component of IBM i versions 7.6, 7.5, 7.4, and 7.3. A local attacker with low privileges can execute arbitrary commands due to improper neutralization of special elements used in an OS command. IBM rates the impact as MEDIUM (...

CVE-2026-17499 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-18073 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements...

CVE-2026-18073

CVE-2026-18073 affects the Debug Server component of IBM i (versions 7.3 through 7.6). A local authenticated attacker can inject parameters into a CL command due to improper neutralization of special elements (CWE-78, OS Command Injection). The CVSS 3.1 base score is 4.4 (Medium) , with impacts t...

CVE-2026-18076 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak...

CVE-2026-18076

IBM i versions 7.3, 7.4, 7.5, and 7.6 are vulnerable in the Debug Server component to a memory leak (CWE-401: Missing Release of Memory after Effective Lifetime). A remote authenticated attacker with low privileges can trigger this to cause a denial of service , rated CVSS 4.3 (Medium) . IBM prov...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Debug Server

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-16826, CVE-2026-17499, CVE-2026-17273, CVE-2026-17259, CVE-2026-18076, CVE-2026-17274, CVE-2026-17270, CVE-2026-18073 in Debug Server as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16826...

CVE-2026-17082 IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name...

CVE-2026-17082

IBM i 7.3–7.6 (5770-SS1) contains CVE-2026-17082 in the Debug Server: remote authenticated attackers can gain elevated privileges due to improper validation of a client-supplied profile name. CVSS v3.1 base score 8.8 (HIGH) with network attack vector, low attack complexity, and privileges require...