Security Bulletin: Multiple Vulnerabilities in Java affecting Rational Application Developer for Websphere Software

Summary There are multiple vulnerabilities in the Java SDK that is used by Rational Application Developer for Websphere Software. July Security Update. CVE-2026-47057, CVE-2026-47063, CVE-2026-60147, CVE-2026-47027, CVE-2026-47021, CVE-2026-16439, CVE-2026-16441, CVE-2026-16243 Vulnerability...

EUVD-2026-66251

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

CVE-2026-80253

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications

Summary Multiple Vulnerabilities were disclosed as part of the Oracle July 2026 CPU plus four additional vulnerabilities Critical Patch Update.. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overfl...

CVE-2026-53924: Improper Access Control

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. Prior to 0xc9d4e0dacd937364793278180551e59d93cd43f9, StreamingEscrow.claim correctly rejects withdrawals while an escrow is...

Dell iDRAC9 7.0.x < 7.00.00.182 / 7.20.x < 7.20.30.50 Improper Access Control (DSA-2026-374)

The version of Dell Integrated Remote Access Controller 9 iDRAC9 running on the remote host is 7.0.x prior to 7.00.00.182, or 7.20.x prior to 7.20.30.50. It is, therefore, affected by an improper access control vulnerability. A remote attacker with low privileges could potentially exploit this...

CVE-2026-20279

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

EUVD-2026-70206

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-20279

Cisco IOS XR Software is affected by improper access control weaknesses (CWE-284) identified through an internal security review and addressed in the September 2026 security hardening release . The CVSS v3.1 score is 9.8 (Critical) , with a vector indicating network attack vector , low complexity...

CVE-2026-20279 Cisco IOS XR Software Security Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-20279 Cisco IOS XR Software Security Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

Security Bulletin: Multiple vulnerabilities affect IBM Sterling Connect:Direct for Microsoft Windows

Summary There are vulnerabilities in IBM Semeru Runtime version 17 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs CVE-2026-41254, CVE-2026-47063, CVE-2026-60147, CVE-2026-46968, CVE-2026-47027,...

Security Bulletin: IBM Security SOAR is vulnerable to using components with known vulnerabilities (CVE-2026-41254, CVE-2026-47057)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM Security SOAR has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an...

CVE-2026-20279: Improper Access Control

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-84651: Improper Access Control

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

CVE-2026-84668: Improper Access Control

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

CVE-2026-84804: Improper Access Control

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...

Improper access control in script-security

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...