CVE-2026-17502 IBM i is Affected By Multiple Vulnerabilities in NetServer

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write...

CVE-2026-17502

CVE-2026-17502 affects IBM i 7.3–7.6 in NetServer. Description: a remote attacker could cause a denial-of-service via an out-of-bounds write. IBM lists the remediation as PTF fixes for each release: 7.6 MJ10939, 7.5 MJ10938, 7.4 MJ10937, 7.3 MJ10936, with fix-information links provided by IBM. No...

EUVD-2026-58460

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write...

CVE-2026-17476

IBM i 7.3–7.6 are affected by CVE-2026-17476, a remote-denial-of-service flaw caused by an improper buffer write. The vulnerability affects IBM i releases 7.3, 7.4, 7.5, and 7.6 and can be triggered remotely without user interaction. IBM’s bulletin lists multiple CVEs (including CVE-2026-17476) i...

CVE-2026-17476 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write...

EUVD-2026-58457

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write...

CVE-2026-72669

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

CVE-2026-72642

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

CVE-2026-17029

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write...

CVE-2026-16887

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write...

EUVD-2026-58386

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write...

CVE-2026-17029

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write...

CVE-2026-17029 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write...

CVE-2026-17029

IBM i 7.3–7.6 are affected by CVE-2026-17029 due to an out-of-bounds write in the Java Secure Sockets Extension (JSSE). The local attacker could execute arbitrary code on the system. CVSS v3.1 base score is 8.8 (LOCAL, LOW complexity, HIGH impact across confidentiality, integrity, and availabilit...

CVE-2026-16887

IBM i 7.6 is affected by CVE-2026-16887, a remote-denial-of-service due to an out-of-bounds write in Dedicated System Tools (DST) / System Service Tools (SST). The vulnerability enables a remote attacker with network access (no user interaction) to trigger a high-severity outage (CVSS v3.1 base s...

CVE-2026-16887

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write...

EUVD-2026-58377

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write...

CVE-2026-45725 compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path...

CVE-2026-45725

compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path...

CVE-2026-45725

CVE-2026-45725 affects compliance-trestle: the remote fetching cache (HTTPSFetcher and SFTPFetcher) constructs local cache paths from URL path components without sanitizing path traversal sequences ("../"). This can cause the HTTP response body to be written to a location outside the intended cac...