CVE-2026-74945

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Graphics: Text component...

CVE-2026-18716 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read...

CVE-2026-18716

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain an out-of-bounds read exploitable by a remote authenticated attacker, enabling sensitive data exposure or denial of service. CVSS 7.9 (High). No patch or workaround details are provided in the documents; see IBM's support page for updates.

CVE-2026-18670 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and potentially disclose sensitive information due to an integer underflow...

CVE-2026-18670

CVE-2026-18670 is an integer underflow vulnerability in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 that allows a remote, unauthenticated attacker to cause a denial of service and potentially disclose sensitive information . The CVSS 3.1 base score is 8.2 (HIGH) with a network attack vector requiri...

CVE-2026-17423

CVE-2026-17423 is an out-of-bounds read vulnerability affecting IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . A local attacker with no privileges and no user interaction can exploit it to obtain sensitive information and cause a denial of service, rated CVSS 7.7 (HIGH) . This CVE is part of a broad...

CVE-2026-17423 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read...

CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

EUVD-2026-63713

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49244

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 contain a path confinement bypass in the public web-client partial ZIP download endpoint for browsable shares. The root cause is a raw byte-prefix comparison used to validate client-supplied file entries instead of a directo...

CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-17060

IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 contain a kernel heap over-read exploitable by an adjacent-network attacker with no privileges, yielding high confidentiality impact and denial of service. CVSS 8.1 HIGH; IBM PSIRT source. No exploitation details or patch versions provided in documents. Moni...

CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

CVE-2026-62945

TREK (a collaborative travel planner) prior to 3.1.3 contains an authorization bypass in its file upload, update, and link endpoints. The affected actions accept attacker-controlled reservation_id, place_id, and assignment_id values without invoking findForeignLinkTarget() to verify that the refe...

CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-17007 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read...

CVE-2026-17007

CVE-2026-17007 is an out-of-bounds read vulnerability in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . A local attacker with high privileges can exploit it to obtain sensitive information or cause a denial of service . The CVSS 3.1 score is 6.7 (MEDIUM) with a changed scope. CISA SSVC assesses expl...

CVE-2026-69855 Microsoft Copilot in Azure Information Disclosure Vulnerability

...

CVE-2026-69855

CVE-2026-69855 is a server-side request forgery (SSRF) vulnerability in Microsoft Copilot in Azure that allows an authorized attacker to disclose information over a network. The CVSS v3.1 base score is 7.7 (HIGH) , reflecting a network attack vector, low complexity, low privileges required, no us...