PT-2026-95372

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules. This occurs because the ACL resolver builds permissions from bucket IDs, but TimeSeries types ...

PT-2026-95465

Name of the Vulnerable Software and Affected Versions IBM MQ Java and JMS client libraries affected versions not specified Description An authenticated attacker can execute arbitrary code on client applications. This is possible due to a deserialization filter bypass occurring during exception...

CVE-2026-77170: Improper Access Control

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...

PT-2026-95669

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A path traversal issue allows a remote authenticated attacker to access and traverse directories on the system. Path traversal is a flaw that allows an attacker to use special characters to...

PT-2026-95631

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Remote authenticated attackers can execute arbitrary code due to improper neutralization of input during web page generation. Recommendations Apply the available patch for version 12.2...

CVE-2026-84036: Improper Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

CVE-2026-84031: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84074: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-81656: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data and impact to the...

PT-2026-95671

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Remote authenticated attackers can execute arbitrary code due to improper neutralization of input during the process of web page generation. Recommendations At the moment, there is no...

PT-2026-95678

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

PT-2026-95471

Name of the Vulnerable Software and Affected Versions IBM MQ for HPE NonStop affected versions not specified Description An authenticated attacker can cause a denial of service or potentially execute arbitrary code. This issue occurs due to improper validation of message distribution list...

PT-2026-95580

Name of the Vulnerable Software and Affected Versions SysReptor Professional versions prior to 2026.61 Description Authenticated users can upload image files that trigger Ghostscript during processing, allowing embedded PostScript to operate within the shared temporary directory. By combining thi...

PT-2026-95674

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-40530: Improper Neutralization of CRLF Sequences

An improper neutralization of CRLF sequences 'CRLF injection' vulnerability in User API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the...

PT-2026-95691

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Remote authenticated attackers can execute arbitrary code due to improper neutralization of input during web page generation. Recommendations At the moment, there is no information about a...

CVE-2026-14472: Improper Neutralization of Input During Web Page Generation

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-95228

Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF versions prior to 6.5.6 Description The plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows authenticated attackers with...

CVE-2026-40532: Direct Request

A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...

PT-2026-95392

Name of the Vulnerable Software and Affected Versions OpenCVE versions prior to 3.0.0 Description Notification testing for Webhook and Slack integrations fails to sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permissions to configure notification...