CVE-2026-50077

Vulnerabilities in the QNX Virtual Machine (QVM) affect the QNX Hypervisor and QNX Hypervisor for Safety . An Invalid Memory Access via the MSI-X table in QVM could allow an attacker residing in the guest to execute arbitrary code within the QVM. This could lead to memory corruption , information...

CVE-2026-50078

The QNX Virtual Machine (QVM) , utilized in QNX Hypervisor and QNX Hypervisor for Safety , contains an Out-Of-Bounds Read vulnerability in the MSI-X table . This flaw could allow an attacker residing in a guest environment to trigger an information disclosure or cause a crash of the QVM. No speci...

CVE-2026-50079

A Time-of-check Time-of-use (TOCTOU) Race Condition exists in the virtio network virtual device within the QNX Virtual Machine (QVM) . This vulnerability affects QNX Hypervisor and QNX Hypervisor for Safety . An attacker operating within the guest environment could manipulate the virtual network ...

CVE-2026-50080

A Stack-based Buffer Overflow exists in the ACPI event handler of the QNX Virtual Machine (QVM) , affecting QNX Hypervisor and QNX Hypervisor for Safety . An attacker residing in a guest environment could crash the QVM by transmitting a crafted ACPI request . The vulnerability is associated with ...

qvm-create-windows-qube

Qvm-Create-Windows-Qube Spin up new Windows qubes quickly, effortlessly and securely About Qvm-Create-Windows-Qube is a tool for quickly and conveniently installing fresh new Windows qubes with Qubes Windows Tools QWT dr...

qvm-tool

Driver scripts These are the analysis drivers used to produce the measurements quoted in the README and in the case notes. They are argument-driven and reusable : each takes the PE path and output paths on the command line. Run from the repository root, e.g.: python scripts/extendedcensus.py...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

EUVD-2026-68212

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636

Qubes OS (specifically qubes-core-dom0-linux before 4.3.22 ) is vulnerable to OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube. The root cause is the use of the system() library function in core-admin-linux/file-copy-vm/qfile-dom0-agent.c to process an er...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636: Improper Neutralization of Special Elements used in an OS Command

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

PT-2026-83556

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

Security Bulletin: Multiple security vulnerabilities in QRadar, QRM, QVM (CVE-2014-0837, CVE-2014-4833, CVE2014-4830, CVE-2014-4827, CVE-2014-4828, CVE-2014-4825)

Summary Multiple security vulnerabilities have been discovered in IBM QRadar, IBM QRadar Vulnerability Manager QVM and IBM QRadar Risk Manager QRM. Vulnerability Details CVE ID: CVE-2014-0837 DESCRIPTION: IBM QRadar is vulnerable due incorrect handing of an SSL connection, caused by the autoupdat...

Security Bulletin: Apache CXF as used by IBM QRadar SIEM is vulnerable to denial of service (DOS) (CVE-2021-30468)

Summary Apache CXF as used by IBM QRadar SIEM is vulnerable to denial of service Vulnerability Details CVEID: CVE-2021-30468 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by an infinite loop flaw in the JsonMapObjectReaderWriter function. By sending a specially-crafted JSON...

Security Bulletin: PostgreSQL as used by IBM QRadar SIEM is vulnerable to information disclosure (CVE-2021-32028, CVE-2021-32027)

Summary PostgreSQL as used by IBM QRadar SIEM is vulnerable to information disclosure Vulnerability Details CVEID: CVE-2021-32028 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to obtain sensitive information, caused by a memory disclosure vulnerability when using an INSERT …...

Security Bulletin: IBM QRadar SIEM is vulnerable to Arbitrary File Read (CVE-2020-4789)

Summary IBM QRadar SIEM is vulnerable to Arbitrary File Read Vulnerability Details CVEID: CVE-2020-4789 DESCRIPTION: IBM QRadar could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view...

QRadar Community Edition 7.3.1.6 PHP Object Injection Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ PHP object injection vulnerability in QRadar Forensics web application ------------------------------------------------------------------------ Abstract...

Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities (CVE-2017-3164)

Summary IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities Vulnerability Details CVEID: CVE-2017-3164 DESCRIPTION: Apache Solr is vulnerable to server-side request forgery, caused by not having corresponding allowlist mechanism in the shards parameter. By using a...