EUVD-2026-86015

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

CVE-2026-81547 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

CVE-2026-81547

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal vulnerability (CWE-22), which could allow a remote authenticated attacker to execute arbitrary commands. The vulnerability has a CVSS base score of 8.8 . To remediate this issue, IBM strongly recommends upgrading to Dat...

CVE-2026-81545 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-81545

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to an OS command injection vulnerability (CWE-78) due to the improper neutralization of special elements used in an OS command. This flaw could allow a remote authenticated attacker to execute arbitrary commands on the system. To r...

CVE-2026-81545 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-81539

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to remote code execution. The flaw stems from the improper neutralization of special elements used in an OS command, which could allow a remote authenticated attacker to execute arbitrary code. No specific exploit details or remediation st...

CVE-2026-81539 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-81539 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

Araxis Merge

RISK EVALUATION Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative user could retrieve and unencrypt other users'...

CVE-2026-77825 IBM ContextForge MCP Gateway is affected by path traversal

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

CVE-2026-77825

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 is vulnerable to a path traversal flaw in the Admin API log-download endpoint (GET /v1/admin/logs/file). The vulnerability stems from the use of str.startswith() for path confinement, which lacks proper boundary validation. This allows an ...

CVE-2026-77825 IBM ContextForge MCP Gateway is affected by path traversal

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

EUVD-2026-86011

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

CVE-2026-77798

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

CVE-2026-17511

The IBM PowerVM Hypervisor is affected by a vulnerability in the partition resource dump interface (CWE-212), which allows an attacker with authenticated administrator-level access to the HMC or service processor to obtain a limited snapshot of partition processor state. This results in a confide...

EUVD-2026-85891

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service...

CVE-2026-17511 This Power System update is being released to address

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service...

CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...

CVE-2026-97061

Versions of Black Candy up to and including 3.2.1 are vulnerable to an information disclosure flaw. The application fails to scope playlist search queries to the currently authenticated session user. Consequently, any authenticated user can query the SearchController or Search::PlaylistsControlle...