CVE-2026-89255: Improper Neutralization of Input During Web Page Generation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

PT-2026-89858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-90445: Improper Limitation of a Pathname to a Restricted Directory

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

Security Updates for Azure CLI (September 2026)

The Microsoft Azure CLI installation on the remote host is missing a security update. It is, therefore, affected by a command injection vulnerability: - Improper neutralization of special elements used in a command 'command injection' in Microsoft Azure CLI allows an authorized attacker to execut...

Ivanti Endpoint Manager Mobile < 12.8.0.4 / 12.9.x < 12.9.0.2 / 12.10.0.0 Privilege Escalation (CVE-2026-18851)

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is prior to 12.8.0.4, or 12.9.x prior to 12.9.0.2. It is, therefore, affected by a privilege escalation vulnerability: - Missing authorization in Ivanti Endpoint Manager Mobile before version...

CVE-2026-82100

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

CVE-2026-82092

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-82098

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-81551

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability...

CVE-2026-80436

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization...

CVE-2026-79742

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

CVE-2026-79723

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints...

CVE-2026-79725

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-75624

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

CVE-2026-78571

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...

CVE-2026-75624

IBM App Connect Enterprise (runtime) versions 13.0.1.0–13.0.8.1 and 12.0.1.0–12.0.12.27 are vulnerable to privilege escalation and Denial of Service due to incorrect authorization (CWE-863). A remote authenticated attacker with low privileges can bypass security restrictions, yielding full compro...

CVE-2026-75624 IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

CVE-2026-75624 IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

CVE-2026-78569 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...

CVE-2026-78569

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is vulnerable to arbitrary code execution by an authenticated attacker due to an incomplete denylist in its agentic assistant code security scanner. The scanner omits process-spawning primitives and contains a logic error where annotated class-body...