CVE-2026-17074 IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management...

CVE-2026-72672

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

CVE-2026-72671

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...

CVE-2026-58433

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...

CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...

CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

CVE-2026-73613

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink...

CVE-2026-73613 filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-123)

Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model,...

PT-2026-71835

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management...

PT-2026-71791

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Kibana Agent Builder fails to properly verify if the requesting user possesses the necessary privileges for a separate Kibana feature before creating and executing a tool that triggers that...

EUVD-2026-57620

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data...

CVE-2026-16480

IBM Db2 11.5.0–11.5.9 and 12.1.0–12.1.5 contain a CWE-602 authorization bypass allowing low-privileged users to modify database catalog data. NVD rates it HIGH (CVSS 7.1); IBM rates it MEDIUM (4.3). Fixes are available via IBM Fix Central security updates. No workarounds are provided. No active e...

CVE-2026-16480 IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data...

CVE-2026-63300

An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...

CVE-2026-18250 IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition...

CVE-2026-70547 Potential unauthorized metadata exposure in JFrog Artifactory

An authenticated user without repository read permission may access package metadata under specific conditions...

CVE-2026-53996 NetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctl

NetBSD's hdaudio4 driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIOFGRPSETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attacker...

CVE-2026-53996

The CVE-2026-53996 entry affects NetBSD's hdaudio(4) driver (sys/dev/hdaudio/hdaudio.c), where a missing access check on /dev/hdaudioN device nodes allows unprivileged local attackers to invoke HDAUDIO_FGRP_SETCONFIG via an IOCTL. A race between thread_stop and thread_disestablish in hdafg_detach...