Security Bulletin: IBM i is Affected By A Privilege Escalation Vulnerability [CVE-2026-18669]

Summary IBM i is vulnerable to privilege escalation CVE-2026-18669 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18669 DESCRIPTION: IBM i is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engi...

Security Bulletin: IBM i is Affected By A Remote Code Execution Vulnerability [CVE-2026-16975]

Summary IBM i is vulnerable to remote code execution due to a heap-based buffer overflow CVE-2026-16975 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16975 DESCRIPTION: IBM i could allow a remote authenticated attacker to execute arbitrary code due to a...

CVE-2026-68154

A flaw was found in the Linux kernel's libceph component. A remote attacker could provide a specially crafted CRUSH map with a zero bucket type. This malformed map could cause the system to treat a negative bucket ID as a device, leading to an out-of-bounds access when indexing the OSD weight...

CVE-2026-73226

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-62893

creationtimestamp| type| source ---|---|--- 2026-08-11 18:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mstbadnmuk25 2026-08-11 19:00:38+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 20:16:38+00:00| seen|...

CVE-2026-73223

CVE-2026-73223 affects electerm: an open-source terminal/SSH/SFTP client. The issue is a path traversal in the SFTP workflow: the filename used by editWithSystemEditor (in src/client/components/sftp/file-item.jsx) is interpolated into path.resolve without sanitization, allowing a malicious SFTP s...

CVE-2026-18692 Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution o...

CVE-2026-18692

Summary: CVE-2026-18692 affects MongoDB Server, specifically its timeseries bucket lifecycle handling. An authenticated user with write privileges can trigger a use-after-free condition in internal memory after a reference is freed, which could cause a server crash or, potentially, execution of u...

Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution o...

CVE-2026-68155

A flaw was found in the libceph component of the Linux kernel. A remote attacker could send a specially crafted monitor map monmap that advertises zero monitors. This malformed monmap is incorrectly processed as valid, which can lead to a client crash when attempting to open a session. This...

CVE-2026-18706

Technical details for CVE-2026-18706 are not publicly available in the provided documents. Monitor for updates; no specific product version, impact, or exploit details are given here.

CVE-2026-18706 Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, executi...

Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, executi...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to OS command injection [CVE-2026-16956]

Summary IBM Db2 Mirror for i is vulnerable to OS command injection as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16956 DESCRIPTION: IBM Db2 Mirror for i could allow a remote attacker to execute arbitrary commands due to improper neutralization of special...

CVE-2026-73222

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...

CVE-2026-73211

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including...

CVE-2016-20097

Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...

CVE-2026-56179

creationtimestamp| type| source ---|---|--- 2026-08-11 18:13:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117078230441993880 2026-08-11 19:02:07+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 20:18:44+00:00| seen|...

CVE-2026-62815

creationtimestamp| type| source ---|---|--- 2026-08-11 17:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mst6gv5bm42q 2026-08-11 19:00:38+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 20:16:33+00:00| seen|...

CVE-2026-71476

A flaw was found in Nx. The self-hosted HTTP remote cache component improperly extracts downloaded cache artifacts, allowing files to be written outside the intended directory. A malicious or on-path Man-in-the-Middle remote cache server can exploit this Zip-Slip vulnerability by providing a...