CVE-2026-105052

IBM Maximo Application Suite versions 8.10, 8.11, 9.0, 9.1, and 9.2 are vulnerable to a path traversal flaw (CWE-22). A remote attacker can exploit this by sending a specially crafted URL request containing "dot dot" sequences (/../) to traverse directories and view arbitrary files on the system....

CVE-2026-105052 IBM Maximo Application Suite Information Disclosure

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

EUVD-2026-97897

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

EUVD-2026-97885

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

CVE-2026-109562

Versions 1.15.10 through 2.2.0 of SnapOtter are vulnerable to a missing authorization flaw. This allows any authenticated principal to access the /api/v1/upload , /api/v1/preview , and /api/v1/preview/generate handlers without proper permission checks. An attacker with a low-privilege settings:re...

CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

EUVD-2026-97882

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109375 Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbol...

CVE-2026-109375

Vercel deepsec (versions 0.1.0 through 1.1.17) is vulnerable to a link following issue within the extractTarballLocally function. This flaw allows sandboxed code, such as a prompt-injected coding agent, to plant symbolic or hard links in the host data directory. By doing so, an attacker can bypas...

CVE-2026-96262

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 are affected by a stack-based buffer overflow (CWE-121) in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware...

CVE-2026-96262 IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowi...

EUVD-2026-97870

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowi...

CVE-2026-96263

IBM Power Systems Firmware is affected by a stack-based buffer overflow (CWE-121) within the host firmware boot process image validation path. An attacker with service access to the service processor can provide a maliciously crafted code update image, leading to arbitrary code execution on the h...

CVE-2026-96263 IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted co...

EUVD-2026-97869

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted co...

CVE-2026-96264 IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowi...

EUVD-2026-97868

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowi...

CVE-2026-96264

IBM Power Systems Firmware (FW1060.00 through FW1060.81) is vulnerable to a stack-based buffer overflow (CWE-121) in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runti...