27517 matches found
EUVD-2026-94985
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system...
CVE-2026-104660
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...
kernel: ipv6: validate extension header length before copying to cmsg
A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...
CVE-2026-93699
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...
CVE-2026-93699
An argument injection vulnerability in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. The root cause is identified as Improper Neutralization of Argument Delimiters in a Command (CWE-88) . The impact includes high severity for confidential...
EUVD-2026-94799
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...
EUVD-2026-94791
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance OVA...
CVE-2026-5049
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...
CVE-2026-87660
An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...
PT-2026-108178
Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Weak cryptographic protection and a hard-coded recovery key exist within the pkcrypto passkey component. A local attacker can exploit this flaw to recover the root password and obtain root...
PT-2026-107803
An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...
PT-2026-108002
Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description...
CVE-2026-87980: Insertion of Sensitive Information into Log File
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs...
CVE-2026-87428: Insufficiently Protected Credentials
In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches...
CVE-2026-107612: Incorrect Permission Assignment for Critical Resource
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global...
CVE-2026-107565: Improper Validation of Specified Quantity in Input
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...
CVE-2026-87660: Incorrect Permission Assignment for Critical Resource
An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...
CVE-2026-107332: Incorrect Default Permissions
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later...
CVE-2026-84250: Use of Hard-coded Credentials
IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges...