CVE-2026-16908

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability...

CVE-2026-16815

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow...

CVE-2026-16722

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management...

CVE-2026-16867

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation...

CVE-2026-16868

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing...

CVE-2026-16859

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...

CVE-2026-16692

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow...

CVE-2026-16674

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path...

CVE-2026-19748

CVE-2026-19748 affects Tenda CH7/CH7G/CH10/CP3/CP3 Pro/CP7/TC3B14C/TC3B15C/TC3T14C/TC3T15C. The vulnerability concerns the function CWebSessionManager_ParseSession in the Kylin Web Service, specifically in the file /user/bin/Kylin. The issue is described as leading to insufficient entropy in the ...

CVE-2026-19748

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManagerParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument...

CVE-2026-19748 Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManagerParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument...

EUVD-2026-58391

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManagerParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument...

EUVD-2026-58389

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-17045

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

EUVD-2026-58387

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal...

CVE-2026-17043

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal...

EUVD-2026-58384

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow...

CVE-2026-16967

IBM i versions 7.6, 7.5, 7.4, and 7.3 are affected by CVE-2026-16967, a TOCTOU race condition involving symbolic links that could let a remote authenticated attacker gain unauthorized access to system objects. CVSS v3.1 base score 8.5 ( HIGH ) with network attack vector, high impact on confidenti...

CVE-2026-16961

IBM i versions 7.4, 7.5, and 7.6 (feature 5770-SS1) are vulnerable to CWE-89 SQL injection in Db2 Mirror, allowing remote attackers to view, add, modify, or delete back-end database data. IBM has issued PTFs SJ10902 (7.6), SJ10908 (7.5), and SJ10910 (7.4) as remediation; no workarounds are provid...

CVE-2026-16961 IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...