169226 matches found
EUVD-2026-85933
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...
CVE-2026-92680 Araxis Merge insufficiently protected credentials
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...
CVE-2026-92680 Araxis Merge insufficiently protected credentials
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...
CVE-2026-92680
Araxis Merge for Windows versions 2011.4074 through 2026.0 are vulnerable to insufficient protection of user-configured credentials for remote servers. The software stores these credentials in the Windows registry without applying adequate cryptographic protection. An authenticated, non-administr...
EUVD-2026-85332
REDAXO: Unwhitelisted ORDER BY Column in rexlist Allows Authenticated Column Enumeration...
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Summary The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable. Although the value is wrapped in backticks via escapeIdentifier preventing classical SQL injection, this still...
GHSA-4F5F-J737-PM58 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Summary The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable. Although the value is wrapped in backticks via escapeIdentifier preventing classical SQL injection, this still...
CVE-2026-63343
A flaw was found in Incus, a system container and virtual machine manager. An authenticated Incus user can exploit this vulnerability by providing a malicious image containing a metadata.yaml symlink that points to an arbitrary host path. This allows the user to read or overwrite any file on the...
CVE-2026-82094 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory...
CVE-2026-82094
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal vulnerability (CWE-22 ) due to improper limitation of a pathname to a restricted directory. A remote authenticated attacker could exploit this to traverse directories on the system. IBM strongly recommends upgrading to ...
CVE-2026-82094 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory...
EUVD-2026-85914
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory...
CVE-2026-82093
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to arbitrary code execution because of the unsafe deserialization of untrusted data. This flaw could be exploited by a remote authenticated attacker . No specific remediation, exploit details, or affected components beyond the software ver...
EUVD-2026-85913
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data...
CVE-2026-82093 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data...
CVE-2026-82093 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data...
CVE-2026-81552 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...
CVE-2026-81552
IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to a flaw that could allow a remote authenticated attacker to execute arbitrary commands . The root cause is identified as the improper neutralization of environment variables . This vulnerability carries a High base severity (CVSS...
CVE-2026-81552 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...