CVE-2026-17004

CVE-2026-17004 affects IBM i on releases 7.6, 7.5, 7.4, and 7.3. The vulnerability could allow a remote attacker to cause a denial of service via an infinite loop on host servers. IBM assigns CVSS v3.1 base score 7.5 (HIGH) with network attack vector, no user interaction required, and impact limi...

EUVD-2026-58235

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop...

CVE-2026-17199 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation...

CVE-2026-17229

IBM i 7.3–7.6 are affected by CVE-2026-17229, a remote-denial-of-service caused by an infinite loop in host servers. Impact: HIGH (CVSS 7.5) with network access and no user interaction required. Affected component: host servers in IBM i V7.x ranges; root cause: loop condition leading to DoS. Reme...

EUVD-2026-58232

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow...

CVE-2026-17220

IBM i 7.3–7.6 is affected by CVE-2026-17220, a buffer overflow in host servers that could allow a remote attacker to cause a denial of service and modify authentication metadata. The vulnerability is described in IBM’s Security Bulletin, which lists the affected releases and associated fixes. Rem...

EUVD-2026-58231

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

CVE-2026-17220 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...

CVE-2026-17197

CVE-2026-17197 (CWE-287: Improper Authentication) affects IBM i 7.3–7.6 host servers, allowing remote unauthenticated attackers to bypass security restrictions via improper client-asserted identity validation. IBM provides PTFs: SJ11101/SJ11097 (7.6), SJ11102/SJ11098 (7.5), SJ11103/SJ11099 (7.4),...

CVE-2026-17197 IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity...

CVE-2026-73482

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2026-18071 IBM i is Affected By An Improper Management Vulnerability in HTTP Server []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management...

CVE-2026-18071

IBM i 7.6, 7.5, 7.4, and 7.3 are affected by CVE-2026-18071 due to improper privilege management in the HTTP Server, enabling a local attacker to gain elevated privileges (CWE-269). Base CVSS v3.1 score is 7.8 (HIGH) with LOCAL, low attack complexity, requiring LOW privileges and no user interact...

CVE-2026-72741

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterpris...

CVE-2026-12236

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

EUVD-2026-58190

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterpris...

CVE-2026-19024

A flaw was found in HDF5. A local attacker could exploit a vulnerability in the H5Pgetfillvalue function by providing a specially crafted dataset. This could lead to a denial of service, making the system unavailable. Mitigation To reduce risk prior to patching, restrict processing HDF5 files fro...

.NET: .NET Denial of Service Vulnerability

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-46382

A flaw was found in the Meeting Room Booking System MRBS. This vulnerability, known as Server-Side Request Forgery SSRF, allows a remote attacker to trick the server into making requests to internal or local network resources. By exploiting this, an attacker could potentially gain unauthorized...

CVE-2026-59196

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to manipulate the package installation process by using a specially crafted lockfile alias. This could lead to path traversal, enabling the attacker to write files outside the designated installation director...