CVE-2026-85457

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

CVE-2026-82108

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-82110

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal...

CVE-2026-82096

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-75061

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

CVE-2026-75063

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding...

CVE-2026-19627

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths...

CVE-2026-109629

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lis...

CVE-2026-109598

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS...

CVE-2026-109601

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

CVE-2026-102627

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction...

CVE-2025-71432

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

CVE-2025-71430

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of othe...

USN-8915-1 ffmpeg vulnerabilities

Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2026-30754 It...

USN-8915-1: FFmpeg vulnerabilities

Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2026-30754 It...

CVE-2026-102627

The IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are vulnerable to a Zip Slip path traversal vulnerability (CWE-22 ). A remote authenticated attacker could exploit improper validation of file paths during archive extraction to achieve arbitrary code execution . The vulnerability ...

CVE-2026-102627 Security Vulnerability identified in IBM TRIRIGA - Zip Slip

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction...

CVE-2026-75063 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding...

CVE-2026-75063

The Planning Analytics Workspace component of IBM Planning Analytics Local versions 2.0 and 2.1 is susceptible to a Cross-Site Scripting (XSS) vulnerability (CWE-79 ). This is caused by improper output encoding , which could allow a remote authenticated attacker to execute arbitrary JavaScript. T...

CVE-2026-75061

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to a path traversal flaw. A remote attacker can exploit this by sending a specially crafted URL request containing "dot dot" sequences (/../) to bypass directory restrictions. This allows the attacker to write arbitrary files on the syste...