CVE-2026-15955: Improper Limitation of a Pathname to a Restricted Directory

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

PT-2026-91714

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation affected versions not specified Description Improper validation of HTTP headers allows a remote attacker to bypass authorization and invoke restricted endpoints. Recommendations At the moment, there is no...

CVE-2026-76442: Improper Validation of Specified Quantity in Input

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple...

PT-2026-91268

Name of the Vulnerable Software and Affected Versions Cisco Secure Email Gateway affected versions not specified Cisco Secure Email and Web Manager affected versions not specified Description Issues exist due to improper validation of specified quantity in input, which can lead to a remote denial...

PT-2026-91162

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...

Linux Distros Unpatched Vulnerability : CVE-2026-90467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO...

CVE-2026-89716

A flaw was found in the zram component of the Linux kernel. This vulnerability occurs because the system does not properly validate user-supplied deflate parameters, specifically winbits values. An attacker could exploit this by providing malformed input, which would trigger an internal error BUG...

CVE-2026-89529

A flaw was found in the Linux kernel's svcrdma component, which handles Remote Procedure Call over Remote Direct Memory Access RPC/RDMA Read operations. This vulnerability occurs because the Read list decoder does not properly validate the lengths of incoming data segments. An attacker could send...

DEBIAN-CVE-2026-80993

In the Linux kernel, the following vulnerability has been resolved: net: phylink: correctly validate returned PCS in phylinkinbandcaps In phylinkinbandcaps, the PCS returned by macselectpcs is only checked if NULL but macselectpcs can also return an error pointer. This can cause a kernel panic as...

UBUNTU-CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89613

A flaw in the Linux kernel's NTFS filesystem driver occurs when it processes an attribute with empty mapping pairs that have an inconsistent highest Virtual Cluster Number (VCN) and size. The fix rejects such invalid attributes. Red Hat describes the impact as a denial of service : a local attack...

EUVD-2026-75877

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...

CVE-2026-88260: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM Build 109...

Improper Validation of Specified Type of Input

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the meta object in calendar events, which is stored without validation. An attacker can disrupt calendar alert functionality for all users by submitting a...

CVE-2026-79723

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints...

CVE-2026-19646

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...

CVE-2026-19646

IBM Common Licensing Agent and IBM ART (Administration and Reporting Tool) versions 9.0, 9.0.0.1, and 9.0.0.2 are affected by improper validation of the HTTP Host header , allowing a remote attacker to redirect users to an arbitrary domain without authentication. The vulnerability is rated CVSS 9...

CVE-2026-19646 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...

CVE-2026-78575 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-89086

CVE-2026-89086 affects the jose package for OCaml, versions before 0.11.0. The vulnerability lies in RSA signature validation: library calls only confirm that PKCS #1 decoding succeeds and then declare the signature valid, skipping the required steps that involve the public key . This means a mal...