SUSE CVE-2026-89635

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...

CVE-2026-93593: Incorrect Authorization

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

PT-2026-95272

Name of the Vulnerable Software and Affected Versions Filter Gallery versions prior to 1.1.5 Description The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to overwrite the title and...

CVE-2025-33141: Exposure of Sensitive System Information to an Unauthorized Control Sphere

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment...

CVE-2025-36076: Inclusion of Sensitive Information in Source Code

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system...

CVE-2025-36178: Improper Validation of Specified Quantity in Input

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size...

PT-2026-95352

Name of the Vulnerable Software and Affected Versions NetBackup Flex OS affected versions not specified Description An authenticated, low-privileged user with access to the management shell can bypass the cryptographic signature verification process of a privileged support command by providing a...

PT-2026-95353

Name of the Vulnerable Software and Affected Versions NetBackup Flex OS affected versions not specified Description An authenticated user with access to the management shell can read arbitrary files from the underlying operating system. This is achieved by providing a specially crafted path...

PT-2026-95693

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A remote authenticated attacker can obtain sensitive information due to improper neutralization of special elements used in an SQL command, which leads to an SQL injection. SQL injection is...

PT-2026-95632

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A missing authorization check in the REST API allows a remote authenticated attacker to gain elevated privileges. Recommendations At the moment, there is no information about a newer versio...

CVE-2026-71537: Concurrent Execution using Shared Resource with Improper Synchronization

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade relies on Service::upgradable to check for a pending service upgrade and later executes $credit-increment'amount', abs$price without DB::transactio...

CVE-2026-63445: Improper Limitation of a Pathname to a Restricted Directory

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-93871: URL Redirection to Untrusted Site

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious...

CVE-2026-28198: Improper Verification of Cryptographic Signature

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted roo...

CVE-2026-4036: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-40536: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40534: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-40531: Integer Overflow or Wraparound

An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks...

CVE-2026-67100: Improper Neutralization of Special Elements used in an SQL Command

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

CVE-2026-93660: Authorization Bypass Through User-Controlled Key

SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles...