CVE-2026-17642 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17248

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command...

CVE-2026-16956

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16906

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command...

CVE-2026-16856

IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command...

CVE-2026-17248 IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command...

CVE-2026-16956

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-16956 due to improper neutralization of special elements used in an OS command, enabling remote command execution. The vulnerability impacts IBM Db2 Mirror for i running these versions and is rated CVSS v3.1 base score 9.8 (...

CVE-2026-16956 IBM Db2 Mirror for i is vulnerable to OS command injection []

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-57380

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16906 IBM i is Affected By Multiple Vulnerabilities in Domain Name System

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command...

CVE-2026-16906

CVE-2026-16906 affects IBM i 7.6 and 7.5. The issue arises from improper neutralization of special elements used in an OS command, enabling a remote authenticated attacker to execute arbitrary commands with elevated privileges. Affects IBM i 7.6 (PTF SJ10931) and 7.5 (PTF SJ11010); IBM lists thes...

EUVD-2026-57377

IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command...

CVE-2026-16856 IBM i is Affected By Multiple Vulnerabilities in Domain Name System

IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command...

CVE-2026-16856

IBM i 7.5 and 7.6 are affected by CVE-2026-16856 (OS Command Injection) due to improper neutralization of special elements in an OS command, enabling a local attacker to gain elevated privileges. The IBM Security Bulletin also notes CVE-2026-16906 in the same DNS/BIND subsystem with identical imp...

CVE-2026-73294

Semaphore UI prior to versions 2.18.17 and 2.19.5-beta2 is affected by an OS command injection in the repository git_url handling. The flaw allows an attacker with project Manager/Owner privileges to influence CmdGitClient.GetLastRemoteCommitHash via a crafted --upload-pack option sent through PO...

CVE-2026-73294 Semaphore U: OS Command Injection

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

CVE-2026-73294 Semaphore U: OS Command Injection

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

GHSA-RHP6-Q4J8-V7V5 vulnerabilities

Vulnerabilities for packages: chromium...

PT-2026-71190

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote authenticated attacker can cause a denial of service due to improper neutralization of special elements in an OS command. This issue occurs when the system fails to properly sanitize input us...

PT-2026-71273

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to properly sanitize inp...