PT-2026-71162

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can modify SQL tables because the system fails to properly neutralize special elements used within an SQL command, leading to an SQL injection issue. Recommendations...

PT-2026-71158

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote authenticated attacker can obtain sensitive information because the system does not properly limit pathnames to restricted directories. Recommendations At the moment, there is no information...

PT-2026-71278

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862...

PT-2026-71268

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can gain elevated privileges due to improper validation of a client-supplied profile name. Recommendations At the moment, there is no information about a newer version...

PT-2026-71164

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input...

PT-2026-71157

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...

Security Bulletin: IBM i is Affected By Multiple SQL Vulnerabilities [CVE-2026-16908, CVE-2026-16967]

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-16908, CVE-2026-16967 in SQL as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16908 DESCRIPTION: IBM i could allow a remote authenticated attacker to gain unauthorized access to arbitrary objec...

Security Bulletin: IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL [CVE-2026-16722]

Summary IBM i is vulnerable to obtaining unauthorized privleges due to improper privilege management CVE-2026-16722 in SQL as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16722 DESCRIPTION: IBM i could allow a remote authenticated attacker to obtain...

Security Bulletin: IBM i is Affected By Out-of-Bounds Read Vulnerability [CVE-2026-16863]

Summary IBM i is vulnerable to obtaining sensitive information due to an out-of-bounds read CVE-2026-16863 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16863 DESCRIPTION: IBM i could allow a remote authenticated attacker to obtain sensitive information d...

CVE-2026-18127

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...

CVE-2026-19111

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

CVE-2026-19111 Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

CVE-2026-18277

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

CVE-2026-18359

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

CVE-2026-18276

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

CVE-2026-18275 Authorization Bypass Through User-Controlled Key in eScriptorium

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-17633

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection...

CVE-2026-17624

CVE-2026-17624 affects IBM Langflow OSS 1.0.0–1.10.3. A remote authenticated attacker could execute arbitrary code due to improper validation of module imports. Documented impact is HIGH (CVE base score 8.5). No exploit details are provided in the available sources. No remediation steps are speci...

CVE-2026-17624 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports...

CVE-2026-17632

CVE-2026-17632 affects IBM Langflow OSS versions 1.0.0–1.10.3. The vulnerability arises from improper validation of Python code during AST-based security scanning, enabling a remote authenticated attacker to execute arbitrary code. The NVD/CVE listings report a high-severity vector with CVSS 3.1:...