EUVD-2026-87097

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...

CVE-2026-85542

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability within the GIM bundle import functionality . An authenticated attacker can supply a maliciously crafted GIM bundle, causing the system to pass attacker-controlled arguments to the tar command . This flaw can lead t...

CVE-2026-85542 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...

CVE-2026-97566 mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...

CVE-2026-97566

The Linux kernel contains a vulnerability in the in-kernel MPTCP path manager where removing the id 0 endpoint fails to tear down pending announcements. This asymmetry between the id 0 path and non-zero id paths leaves a stale ADD_ADDR announcement entry alive. When the path manager later reselec...

ROOT-APP-NPM-CVE-2026-53655 CVE-2026-53655 in tar - Patched by Root

Root has patched CVE-2026-53655 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41239 CVE-2026-41239 in dompurify - Patched by Root

Root has patched CVE-2026-41239 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-49458 CVE-2026-49458 in dompurify - Patched by Root

Root has patched CVE-2026-49458 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54288 CVE-2026-54288 in hono - Patched by Root

Root has patched CVE-2026-54288 in the hono package for Root:npm. Multiple fixed versions available...

Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass

Ivanti Endpoint Manager Mobile EPMM, formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available. id: CVE-2023-35078 info...

The vulnerability of the package manager for Kubernetes Helm, related to unvalidated array indexing, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the package manager for Kubernetes Helm is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2026-97566: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...

PT-2026-98407

Name of the Vulnerable Software and Affected Versions misp-modules affected versions not specified Description The cisco firesight manager ACL rule export module generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration...

PT-2026-98506

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The in-kernel MPTCP path manager contains an asymmetry between removal paths that can leave a stale ADD ADDR announcement entry active when removing the id 0 endpoint. This occurs becaus...

CVE-2026-86066: Cross-Site Request Forgery (CSRF)

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

Adobe Experience Manager Forms JEE <= 6.5.25 / 6.5 LTS SP2 Multiple Vulnerabilities (APSB26-151)

The version of Adobe Experience Manager Forms JEE installed on the remote host is 6.5.25 or earlier, or 6.5 LTS SP2 or earlier. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-151 advisory. - Adobe Experience Manager Forms JEE is affected by an Incorrect...

PT-2026-98992

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

SUSE SLES15: Multi-Linux-Manager-Server-SLE-release / mgradm / etc (SUSE-SU-2025:3839-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:3839-1 advisory. Multi-Linux-Manager-Server-SLE-release: - Update for the release packages for fixing the EOL - Fixed migration issue bsc1243486 server-attestation-imag...

PT-2026-99059

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software exposes appKey and appSecret credentials via the 'GET /application/manager/select' endpoint. This occurs because the endpoint lacks authentication and field filtering, allowing...

CVE-2026-100192: Missing Authentication for Critical Function

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...