Security Bulletin: IBM i is Affected by an Improper Validation Vulnerability [CVE-2026-17275]

Summary IBM i is vulnerable to unauthorized manipulation of distributed transactions due to improper validation CVE-2026-17275 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17275 DESCRIPTION: IBM i could allow a remote attacker to perform unauthorized...

CVE-2026-14814

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

CVE-2026-14814 Permissive Regular Expression in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

EUVD-2026-98177

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input...

CVE-2026-93886

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input...

CVE-2026-14814: Permissive Regular Expression

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

PT-2026-111167

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 19.2.8 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description Improper validation of repository references allows a user to poison cached responses for raw repository file...

PT-2026-111391

Name of the Vulnerable Software and Affected Versions .NET Client Library for SIMATIC S7 Webserver API versions prior to 3.3.61 Description Applications using the library do not properly validate filenames received from remote servers during ticket downloads. An attacker capable of manipulating t...

CVE-2026-19622

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to an authentication bypass and privilege escalation. The root cause is the improper validation of sub-requests , which allows a remote attacker to bypass security controls. This vulnerability is associated with CWE-288 (Authentication By...

CVE-2026-19622 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

CVE-2026-19627

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to a security flaw caused by improper validation of file paths . This allows a remote attacker to read arbitrary host files and overwrite certain application files . The vulnerability is associated with CWE-22 (Path Traversal). No specifi...

K000163668: Go vulnerability CVE-2024-9341

Security Advisory Description A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system int...

CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch

Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed regist...

CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch

Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed regist...

EEF-CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch

Summary Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signe...

CVE-2026-105280

The hexpm hex package (versions 0.20.2 before 2.5.2 ) is vulnerable to an Improper Validation of Integrity Check Value (CWE-354). When using mix hex.package fetch PACKAGE VERSION --output -, the tool writes bytes from Hex.SCM.fetch/3 directly to standard output without performing the required che...

CVE-2026-93693

Progress ShareFile Storage Zones Controller versions v5.12.6 and below are vulnerable to a vulnerability chain involving improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on the queue service. A remote unauthenticate...

CVE-2026-107429

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-107429 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-107429

The WordPress Paid Videochat Turnkey Site (ppv-live-webcams) plugin is vulnerable to an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284) in versions up to and including 7.5.12 . This flaw allows for Input Data Manipulation . While the specific component or function is n...