CVE-2026-18848 Power System Cross-Site Request Forgery (CSRF)

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific condition...

CVE-2026-18848

The IBM Power Systems ASMI web interface has a CSRF flaw (CWE-352): an attacker can lure a logged-in ASMI admin to a crafted page to silently execute administrative actions on the FSP, affecting confidentiality, integrity, and availability. IBM provides no workarounds; customers must upgrade to F...

EUVD-2026-62686

IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system,...

CVE-2026-17494

CVE-2026-17494 is a stack-based buffer overflow (CWE-121) in the interface between the BMC and host system of IBM Power Systems Firmware. Affected versions are FW1120.00 and FW1110.00 through FW1110.30 . An attacker with service access to the BMC can send a specially crafted command to achieve ar...

CVE-2026-17494 Power System Buffer Overflow

IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system,...

CVE-2026-18681

CVE-2026-18681 is a stack-based buffer overflow (CWE-121) in the FSP firmware update process of IBM Power Systems Server Firmware. An attacker with authenticated administrator-level access to the FSP over an adjacent network can execute arbitrary code, leading to full compromise of confidentialit...

CVE-2026-72477

A flaw was found in the Linux kernel's NTFS3 file system driver. This vulnerability occurs when a file rename operation fails, potentially leaving the file system in an inconsistent state. This inconsistency could lead to system instability or data integrity issues. The resolution ensures that...

CVE-2026-60798

creationtimestamp| type| source ---|---|--- 2026-08-19 18:16:02+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-74521

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel Server Message Block SMB server. This vulnerability stems from a logic error in how ClientGUIDs, which are unique client identifiers, are compared. The strncmp function, used for this comparison, stops at the first null...

CVE-2026-49392

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile and DB::searchFile in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems,...

EUVD-2026-62577

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile and DB::searchFile in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems,...

CVE-2026-49392

Wazuh (free and open source threat prevention, detection, and response platform) is affected by a local SQL injection in its File Integrity Monitoring (FIM) database layer. The vulnerable functions DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored fil...

CVE-2026-49392 Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile and DB::searchFile in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems,...

CVE-2026-16819

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition...

MINI-9WG7-72P5-MMGM

Bulletin has no description...

CVE-2026-16819 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition...

CVE-2026-16819

A local attacker with no privileges can exploit a TOCTOU race condition in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 to cause denial of service (HIGH availability impact) and compromise data integrity (HIGH integrity impact). CVSS 7.7 (HIGH), local vector, no user interaction required. Exploitation ...

EUVD-2026-62531

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition...

curl: curl: Cookie injection via malicious HTTP server using super cookies

A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...

PYSEC-2026-3670 JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...