CVE-2026-18888 MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt...

CVE-2026-19002

The CVE-2026-19002 entry affects the MongoDB BI Connector ODBC Driver. A missing bounds check during parsing of stored procedure parameter metadata can cause an out-of-bounds write in the client process, leading to memory corruption and potential abnormal termination or, under certain conditions,...

CVE-2026-19002 Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its...

CVE-2026-54463 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, gitlab-rails-ce, commercial-gitlab-rails-ee...

CVE-2026-19643

AWS SDK for C++ base64 decoding exposed an out-of-bounds read on some platforms prior to 1.11.862, which could allow a remote authenticated user to crash an application processing crafted Base64 input. Remediation: upgrade to aws-sdk-cpp 1.11.862 or later. This CVE is documented across NVD and CV...

CVE-2026-19643 Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862...

next: Next.js: Server-Side Request Forgery vulnerability

A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery SSRF or Open Redirect attacks. When a rewrites or redirects rule constructs an external destination hostname using attacker-controlled...

vpulse

VPulse Automated web security audit toolkit with screenshot...

CVE-2026-18499

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives...

SUSE CVE-2026-59091

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts witho...

CVE-2026-65941

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

EUVD-2026-57267

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65941

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65941 WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65941

CVE-2026-65941 affects WhatsUp Gold releases prior to 2026.0.2. An unauthenticated remote attacker with network access to the affected IIS-backed service can execute arbitrary code in the context of the IIS application service account. The CVE is documented by NVD and CVE records, with a high imp...

Security Bulletin: IBM Maximo Application Suite uuid-9.0.1.tgz which is vulnerable to CVE-2026-41988.

Summary IBM Maximo Application Suite uses uuid-9.0.1.tgz which is vulnerable to CVE-2026-41988. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-41988 DESCRIPTION: uuid before 14.0.0 can make unexpected writes when external outpu...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a privilege escalation (CVE-2026-18499)

Summary IBM WebSphere Application Server Liberty is affected by a privilege escalation with the collectiveController-1.0 or collectiveMember-1.0 enabled. Vulnerability Details CVEID:CVE-2026-18499 DESCRIPTION: IBM WebSphere Application Server Liberty is vulnerable to a privilege escalation when...

Security Bulletin: IBM Maximo Application Suite uses js-yaml-4.1.1.tgz which is vulnerable to CVE-2026-53550.

Summary IBM Maximo Application Suite uses js-yaml-4.1.1.tgz which is vulnerable to CVE-2026-53550. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1,...

CVE-2026-72526

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...