CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2026-102831 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2026-102830 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-102821 Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...

CVE-2026-84414

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-84436

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges...

CVE-2026-102727

FTP Passive Data Connection Not Bound to the Authenticated Control Peer...

CVE-2026-102242

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

CVE-2026-84414 IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-84414 IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

EUVD-2026-89202

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-102727

FTP Passive Data Connection Not Bound to the Authenticated Control Peer...

EUVD-2026-89197

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...

CVE-2026-84421 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...

CVE-2026-84421

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to remote code execution because of improper path validation during archive extraction . This flaw, categorized under CWE-22: Path Traversal , allows a remote authenticated attacker to execute arbitrary code. To remediate this vulnerabilit...

CVE-2026-84436 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges...

CVE-2026-84436

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection within the certificate export CLI functionality . A privileged authenticated CLI user can exploit this vulnerability to execute arbitrary commands with root privileges . This issue is caused by the improper neutralization of ...

EUVD-2026-89192

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by the SNMP alerter service, which runs...

CVE-2026-19743

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...