Security Bulletin: IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service (CVE-2026-75624)

Summary IBM App Connect Enterprise runtime is vulnerable to privilege escalation and Denial of Service. Vulnerability Details CVEID:CVE-2026-75624 DESCRIPTION: IBM App Connect Enterprise could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

EUVD-2022-56044

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket for STARTBREAK and CRACKBREAK actions or in UseItemTransactionData typically within InventoryTransactionPacket. A remote authenticated attacker can send crafted packets with invalid facing values e.g., negative or...

CVE-2026-14297 The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service CGMS Record Access Control Point RACP write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on...

PT-2026-86777

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket for START BREAK and CRACK BREAK actions or in UseItemTransactionData typically within InventoryTransactionPacket. A remote authenticated attacker can send crafted packets with invalid facing values e.g., negative or...

CVE-2026-86112 BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

CVE-2025-14945: Improper Neutralization of Input During Web Page Generation

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...

CVE-2026-50894

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...

CVE-2026-18486

IBM ContextForge MCP Gateway = v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters...

CVE-2026-17622

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-17444

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

EUVD-2026-71477

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference...

CVE-2026-18078

IBM i 7.3–7.6 are affected by a Denial of Service vulnerability in the Save Restore feature (5770-SS1), caused by an integer overflow or wraparound (CWE-190). A remote authenticated attacker can trigger the DoS over the network with low attack complexity and no user interaction, resulting in a lo...

CVE-2026-19283

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

CVE-2026-19301 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

EUVD-2026-71597

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

EUVD-2026-71596

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...

CVE-2026-85624

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...

CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations , allowing authenticated attackers to inject their own task runs into other organizations' or projects' environments. The result is resource consumption on the victim's environment and pollution...