Security Bulletin: Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication

Summary GWT Mock Authentication Privilege Escalation in IBM TRIRIGA Vulnerability Details CVEID:CVE-2026-107400 DESCRIPTION: IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. CWE:CWE-287: Improper Authentication CVSS Source: IBM CVSS...

Security Bulletin: Security Vulnerability identified in IBM TRIRIGA - Zip Slip

Summary Security Vulnerability in IBM TRIRIGA - Zip Slip Path Traversal Vulnerability Details CVEID:CVE-2026-102627 DESCRIPTION: IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths duri...

Security Bulletin: Security Vulnerability identified in IBM TRIRIGA - XXE ( XML External Entitity )

Summary There is a vulnerability in IBM TRIRIGA - XXE XML External Entitity Vulnerability Details CVEID:CVE-2026-93891 DESCRIPTION: IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE...

Security Bulletin: Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

Summary Session Token exposure in Admin console in versions below 5.0.9 Vulnerability Details CVEID:CVE-2026-93892 DESCRIPTION: IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the...

EUVD-2026-103137

IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive...

CVE-2026-17491 IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH

IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive...

CVE-2026-17491

IBM i versions 7.3, 7.4, 7.5, and 7.6 (product 5733-SC1) are vulnerable to an improper privilege management flaw (CWE-269) in OpenSSH . The root cause is the improper enforcement of the ChrootDirectory configuration directive, which could allow a remote authenticated attacker to bypass security r...

CVE-2026-109839 IBM Db2 Genius Hub Missing Cryptographic Step

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...

CVE-2026-109839

IBM Db2 Genius Hub 1.0 is vulnerable to a security restriction bypass because of a missing initialization vector in its cryptographic algorithm (CWE-325). This flaw could be exploited by a remote authenticated attacker to impact the integrity of the system. To remediate this vulnerability, users ...

Security Bulletin: IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI [CVE-2026-96119]

Summary IBM i is vulnerable to allowing a remote authenticated attacker to execute arbitrary code due to improper data sanitization CVE-2026-96119 in HTTP Server Administration Graphical User Interface GUI as described in the vulnerability details section. Vulnerability Details ID: CVE-2026-96119...

PT-2026-116138

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description An improper privilege management issue in OpenSSH allows a remote authenticated attacker to bypass security restrictions. This occurs due to the improper enforcement of the ChrootDirectory configurati...

CVE-2026-84790

A flaw was found in OpenVPN. This vulnerability allows a remote authenticated attacker to impersonate other users by submitting a specially crafted certificate subject field during authentication. By assuming the identity of a different user, an attacker can gain unauthorized access to restricted...

CVE-2026-105474

A server-side template injection vulnerability exists in SolusVM 2 up to version 2.0.0-44576 . This flaw allows remote authenticated users to achieve arbitrary code execution with root privileges. The vulnerability is associated with CWE-1336 (Improper Neutralization of Special Elements Used in a...

CVE-2026-84471

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-84471

A use-after-free vulnerability exists in OpenVPN versions 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 . The flaw resides in the TLS session handling and stems from an incomplete fix for CVE-2026-12996. It allows remote authenticated peers to trigger a denial of service (causing the applicat...

CVE-2026-84471

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

EUVD-2026-100750

OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

Security Bulletin: IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH [CVE-2026-17491]

Summary IBM i is vulnerable to bypassing security restrictions due to improper enforcement of ChrootDirectory CVE-2026-17491 in OpenSSH as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17491 DESCRIPTION: IBM i could allow a remote authenticated attacker to...

CVE-2026-109412

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information...

CVE-2026-106042

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application...