CVE-2026-95209

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

UBUNTU-CVE-2026-95209

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Security Bulletin: IBM i is Affected By Relative Path Traversal Vulnerability in OpenSSH [CVE-2026-59995]

Summary IBM i is vulnerable to not properly constraining the location of downloaded files when "sftp server:/path" is used CVE-2026-59995 in OpenSSH as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-59995 DESCRIPTION: sftp in OpenSSH before 10.4 does not...

Security Bulletin: IBM SPSS Modeler is affected by an Apache Ivy path traversal vulnerability that could allow arbitrary file overwrite during package processing

Summary IBM SPSS Modeler is affected by an Apache Ivy path traversal vulnerability that could allow arbitrary file overwrite during package processing. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-26032 DESCRIPTION: The PackagerResolver of Apache Ivy is...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (September 2026 - Part 2 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-69153 DESCRIPTION: PostCSS takes a CSS file and provides an API to...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale native REST API are now fixed in 5.2.3.10 or higher and 6.0.1.2 or higher

Summary The following vulnerabilities that can affect IBM Storage Scale native REST API are now fixed in 5.2.3.10 or higher and 6.0.1.2 or higher Vulnerability Details ID:WS-2026-0025 DESCRIPTION: Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RB...

GHSA-Q7M5-3JMV-VM48 PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

ContextGatherer include resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonai.ui.context.ContextGatherer treats the configured directory as the project workspace, but project-controlled .praisoncontext and .praisoninclude files can name absolute paths...

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

ContextGatherer include resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonai.ui.context.ContextGatherer treats the configured directory as the project workspace, but project-controlled .praisoncontext and .praisoninclude files can name absolute paths...

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

GHSA-XPX6-X8C2-MW5W PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Summary Handlebars.compile and Handlebars.precompile accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into...

GHSA-8R5X-FM3F-WHWJ Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Summary Handlebars.compile and Handlebars.precompile accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into...

GHSA-MX22-3794-2VPV Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Summary extractPivotTableFields builds order := pc.getPivotCacheFieldsName from xl/pivotCache/pivotCacheDefinitionN.xml's list, then indexes it with values taken from a separately parsed xl/pivotTables/pivotTableN.xml part with zero cross-validation: orderfield.Fld where field.Fld is a raw...

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Summary extractPivotTableFields builds order := pc.getPivotCacheFieldsName from xl/pivotCache/pivotCacheDefinitionN.xml's list, then indexes it with values taken from a separately parsed xl/pivotTables/pivotTableN.xml part with zero cross-validation: orderfield.Fld where field.Fld is a raw...

GHSA-3WR7-993Q-JRFF Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Summary Coraza extracts a multipart file upload's filename using Go's standard-library mime.ParseMediaType, which only decodes the RFC 5987/6266 extended filename Content-Disposition parameter when its declared charset is exactly us-ascii or utf-8. Any other charset — including iso-8859-1, which...

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Summary Coraza extracts a multipart file upload's filename using Go's standard-library mime.ParseMediaType, which only decodes the RFC 5987/6266 extended filename Content-Disposition parameter when its declared charset is exactly us-ascii or utf-8. Any other charset — including iso-8859-1, which...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Samba Cluster Export Services (CES) layer are now addressed in 6.0.1.2 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the Samba Cluster Export Services CES layer and could provide weaker-than-expected security, are now addressed in Storage Scale 6.0.1.2 or higher. Vulnerability Details CVEID:CVE-2026-58224 DESCRIPTION: A flaw was found...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale cloudkit are now fixed in 5.2.3.10 or higher and 6.0.1.2 or higher

Summary The following vulnerabilities that can affect IBM Storage Scale cloudkit are now fixed in 5.2.3.10 or higher and 6.0.1.2 or higher Vulnerability Details CVEID:CVE-2026-84445 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with...

Security Bulletin: IBM Cloud Pak System is affected by vulnerability [CVE-2026-13463]

Summary Vulnerabilities was addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-13463 DESCRIPTION: IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files. CWE:CWE-798: Use of...

GHSA-WF65-4JJX-Q444 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE...