CVE-2026-15955 IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-15955

IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.5 (Client editions on Linux and Unix ; Windows unaffected) are vulnerable to arbitrary file write via the IBM Data Server driver for JDBC and SQLJ . The root cause is improper validation of file paths (CWE-22 / Path Traversal), allowing a malicious D...

CVE-2026-15955 IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

EUVD-2026-78054

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-16338 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

EUVD-2026-77797

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-16338 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ could allow an evil server to perform an arbitrary file write on the connected client due to improper validation of file paths (CVE-2026-15955)

Summary IBM® Data Server driver for JDBC and SQLJ could allow an evil Db2 server to perform an arbitrary file write on the connected client due to improper validation of file paths. This vulnerability also applies to Db2 due to bundled JDBC and SQLJ components. Vulnerability Details...

Astra Linux – Vulnerability in oddjob

A race condition was identified in the mkhomedir tool included with the oddjob package in versions prior to 0.34.5 and 0.34.6. During the home creation process, mkhomedir copies the /etc/skel directory into the newly created home directory and changes its ownership to the home’s user, without...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to version 1.16.4, the caching mechanism for ld.so removed outdated cache files without properly checking whether the app’s control over the path to the outdated cache was valid within the cache directory. This allowed...

PT-2026-91701

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...

CVE-2026-65382: Improper Limitation of a Pathname to a Restricted Directory

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

CVE-2026-86910: Improper Limitation of a Pathname to a Restricted Directory

A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files...

CVE-2026-84609: Buffer Copy without Checking Size of Input

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files...

PT-2026-91543

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

PT-2026-91625

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

CVE-2026-86902: Improper Limitation of a Pathname to a Restricted Directory

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...

Important: samba

Issue Overview: A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for syst...

PT-2026-91655

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files...

PT-2026-91706

A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files...