CVE-2026-82108 DataStage on Cloud Pak for Data Code Injection

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-82108

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a code injection vulnerability (CWE-94). A remote authenticated attacker can execute arbitrary code because the software fails to properly neutralize special elements used in OS commands . This vulnerability carries a High base severity...

CVE-2026-82108 DataStage on Cloud Pak for Data Code Injection

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-84418 DataStage on Cloud Pak for Data Improper Certificate Validation

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...

CVE-2026-84418 DataStage on Cloud Pak for Data Improper Certificate Validation

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...

CVE-2026-84418

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a man-in-the-middle attack due to improper certificate validation (CWE-295). An attacker can present a forged TLS certificate to intercept the connection and capture the IAM bearer Authorization header automatically attached by the sess...

CVE-2026-109674

The Frappe ERPNext application is vulnerable to an SQL injection vulnerability in versions prior to 15.98.0 and 16.x before 16.6.0. The root cause is missing input validation in certain endpoints, which allows remote authenticated attackers to submit specially crafted requests. Successful exploit...

CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...

CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...

CVE-2026-109673

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

CVE-2026-109673 Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

CVE-2026-109673 Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

CVE-2026-109673

Frappe ERPNext versions prior to 15.103.0 and 16.x before 16.12.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the improper neutralization of certain record names when rendered on specific dashboards, tools, and portals. Authenticated attackers can craft malicious...

CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109672

Frappe ERPNext is vulnerable to a missing authorization vulnerability in certain endpoints prior to versions 15.118.0 and 16.27.0 . This flaw allows authenticated users to bypass role-based access controls and query endpoints to access sensitive financial data beyond their permitted privileges. N...

CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109670 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

CVE-2026-109670 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

CVE-2026-109670 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...