CVE-2026-18102

IBM i versions 7.3 through 7.6 (feature 5770-999) contain a heap-based buffer overflow (CWE-122) caused by an integer underflow during bounds checking . A remote authenticated attacker can exploit this to overwrite adjacent memory, resulting in a partial integrity impact. NVD rates it 4.3 MEDIUM ...

CVE-2026-16838

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...

EUVD-2026-62741

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...

CVE-2026-55086 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...

CVE-2026-55086

Etherpad (ep_etherpad-lite) versions prior to 3.1.0 are vulnerable to a symlink-based file overwrite via predictable temporary filenames. The ImportHandler.ts and ExportHandler.ts components derive temp-file paths from Math.random() (~32 bits of entropy), which is predictable within the same Node...

EUVD-2026-62727

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...

CVE-2026-16838 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...

CVE-2026-16838 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...

CVE-2026-49976

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-19875

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

EUVD-2026-62606

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...

CVE-2026-19875

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain an authentication bypass in the POST /api/v2/registration/ endpoint (CWE-306). An unauthenticated remote attacker can overwrite the server's registered admin email address and trigger outbound telemetry calls, enabling the instance to be abus...

CVE-2026-19875 Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...

CVE-2026-19875 Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...

CVE-2026-41424

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

CVE-2026-53803

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation. Mitigati...

CVE-2026-49441 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-49441 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-49441

Wazuh versions 4.3.0 through 4.14.6 and 5.0.0-beta3 are affected by an arbitrary file write vulnerability in the cluster master component. The non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json...