CVE-2026-89121

SAP S/4HANA is vulnerable to a missing authorization check within the Linear Asset Management RAP Business Object . The root cause is the system's failure to perform sufficient instance-level authorization checks during certain modification operations on associated business object data. An attack...

CVE-2026-89120

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from the FLP . A low-privileged attacker could exploit this by sending specially crafted requests to bypass res...

CVE-2026-96266

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage...

CVE-2026-96261

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash...

CVE-2026-96261

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 are vulnerable to a stack-based buffer overflow (CWE-121) during host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can provide specially crafted configuration data, caus...

EUVD-2026-97871

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash...

CVE-2026-96265 IBM Power Systems Firmware Improper Memory Buffer Restriction

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory,...

EUVD-2026-97867

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory,...

CVE-2026-96265

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 are vulnerable to a memory buffer restriction issue (CWE-119 ) within the service processor mailbox interface . An attacker with authenticated service-level access to the FSP can transmit a specially crafted mailbox message to read o...

CVE-2025-0108-SCAN

CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS...

CVE-2026-105801 openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement

A flaw was found in Netty. Netty's DNS Domain Name System codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the...

netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement

A flaw was found in Netty. Netty's DNS Domain Name System codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the...

netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement

A flaw was found in Netty. Netty's DNS Domain Name System codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the...

netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement

A flaw was found in Netty. Netty's DNS Domain Name System codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the...

CVE-2026-88038

A flaw was found in the cookies Node.js library. This vulnerability allows a remote attacker to inject additional cookie attributes into the Set-Cookie header by providing untrusted data to the domain or path options. This occurs because the library's validation for these options is permissive,...

AlmaLinux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests (ALMALINUX9.6:CLSA-2026:1776968105)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776968105 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

Security Bulletin: This Power System update is being released to address CVE-2026-96261

Summary Power Systems Firmware is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory...

Linux Distros Unpatched Vulnerability : CVE-2026-100664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header...

Incorrect Behavior Order: Validate Before Canonicalize

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the load method in jwt/apijws.py, which accepts non-canonical base64url-encoded JWS segments. Because the library does not verify...