CVE-2026-17485

IBM i is affected by CVE-2026-17485 due to an integer underflow in System Service Tools (SST), leading to remote denial of service and potential exposure of sensitive information. Affected products and versions: IBM i 7.6 (5770-999), 7.5 (5770-999), 7.4 (5770-999), and 7.3 (5770-999). The issue i...

EUVD-2026-57530

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

Next.js: Next.js: Denial of Service via Image Optimization API

A flaw was found in Next.js. When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. A remote attacker could exploit this by requesting large local assets from the /next/image endpoint...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

CVE-2026-17445

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name...

CVE-2026-17271

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size...

CVE-2026-16907

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...

CVE-2026-16907 IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...

CVE-2026-17271

IBM i is affected by multiple vulnerabilities in the Debug Server, including CVE-2026-17271 which could allow a remote attacker to cause a denial of service due to improper validation of input size. Affected are IBM i releases 7.6, 7.5, 7.4, and 7.3 (5780-SS1 family), with the CVE described in IB...

EUVD-2026-57380

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16931

CVE-2026-16931 affects IBM i releases 7.6, 7.5, 7.4 and 7.3. A remote attacker could cause a denial of service through improper handling of zero-length TCP options. The vulnerability has a CVSS v3.1 base score of 7.5 (NETWORK, HIGH impact on availability; no impact on confidentiality/integrity). ...

CVE-2026-17266 IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-18246

CVE-2026-18246 affects IBM i 7.3–7.6, classified as CWE-436 (Interpretation Conflict) in the multipart parser of Navigator for i, allowing authenticated remote attackers to bypass security restrictions (CVSS 3.0 LOW). IBM has released PTFs SJ10887 (7.6), SJ10888 (7.5), SJ10890 (7.4), and SJ10891 ...

EUVD-2026-57349

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

CVE-2026-73228

A flaw was found in Django REST framework. A remote attacker could exploit a vulnerability in the request.data parsing mechanism, which bypasses Django's DATAUPLOADMAXMEMORYSIZE protection. This allows an attacker to send oversized JSON and URL-encoded request bodies, leading to excessive...

CVE-2026-19173

A flaw was found in Skia, a 2D graphics library utilized within Chromium-based browsers. A remote attacker, having already compromised the browser's renderer process, could exploit an out-of-bounds write vulnerability. This exploitation occurs by enticing a user to visit a specially crafted HTML...

Denial-of-service (DoS)

Apache HttpComponents Core is vulnerable to a denial-of-service DoS vulnerability. The vulnerability is due to the decoder processing oversized compressed HTTP/2 header blocks without applying the configured header list size limit until the SETTINGS acknowledgement, which allows a remote attacker...

Security Bulletin:Vulnerability in httpcore affects IBM Netezza Appliance

Summary The httpcore package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-54399 Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core...

EUVD-2025-210706

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted...