CVE-2026-35001

OpenS100 through commit daa35b contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser that allows remote attackers to cause a heap-based buffer overflow by opening a crafted S-102 HDF5 file with malicious grid dimension metadata. Attackers can exploit the unvalidated...

Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access. Vulnerability Details CVEID:CVE-2026-16830 DESCRIPTION: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote...

CVE-2026-89107

SAP S/4HANA Manage Substitution/Validation Rules does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpret...

EUVD-2026-98214

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular...

EUVD-2026-98176

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application...

EUVD-2026-98068

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-98070

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal...

EUVD-2026-98074

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

EUVD-2026-98083

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction...

CVE-2026-89107 Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

SAP S/4HANA Manage Substitution/Validation Rules does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpret...

EUVD-2026-98190

SAP S/4HANA Manage Substitution/Validation Rules does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpret...

CVE-2026-89107

The SAP S/4HANA (Manage Substitution/Validation Rules) component is vulnerable to a Code Injection vulnerability (CWE-94). The issue stems from insufficient validation of input processed by rule definition functionality that uses a domain-specific scripting language. An authenticated attacker wit...

CVE-2026-96119

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application...

pcre2: pcre2: Out-of-bounds write via crafted regular expression

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...

pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...

Important: Red Hat Security Advisory: pcre2 security update

An update for pcre2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

ROS-20261013-73-0102

The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-103845: Uncontrolled Search Path Element

Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user...

CVE-2026-106617: Incorrect Authorization

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

MiracleLinux 8 : dovecot-2.3.16-16.el8_10 (AXSA:2026-2032:07)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2032:07 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorre...