CVE-2026-11926 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

EUVD-2026-78882

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and...

CVE-2026-12351

IBM MQ versions 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 LTS, and 10.0.0.0 are vulnerable to unauthenticated remote code execution via JNDI injection in the Jakarta Resource Adapter IVT servlet . The root cause is unsafe JNDI lookup processing (CWE-74). When...

EUVD-2026-78876

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-12358 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-12751 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-12751 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-12751

IBM Cloud Pak for Business Automation is vulnerable to HTML injection , allowing a remote attacker with low privileges to inject malicious HTML that executes in the victim's browser within the security context of the hosting site. The CVSS 3.1 score is 5.4 (Medium) with a changed scope and low im...

CVE-2026-91986

A flaw was found in gix-transport. This vulnerability allows a remote attacker to inject control characters, specifically NUL, Carriage Return CR, and Line Feed LF bytes, into git-daemon connect requests by crafting malicious git URLs. This injection can lead to spoofing of virtual hosts or the...

CVE-2026-91990

A flaw was found in Tornado. This memory amplification vulnerability exists in the parsemultipartformdata function, where multipart data is processed before validating the maximum number of parts. A remote attacker can exploit this by sending specially crafted multipart requests with numerous...

USN-8768-1: Shibboleth vulnerability

Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information...

CVE-2026-45765

A flaw was found in Suricata. DNP3 reassembly could buffer data without sufficient parser-level bounds. A remote attacker sending crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in a denial of service. Mitigation Disable DNP3 parsing in the Suricata...

python: Python unicodedata: Denial of Service due to excessive CPU consumption

A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

ROS-20260915-73-0151

The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-93127

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A type confusion issue exists in the ServiceWorker component. This occurs when the system incorrectly identifies the data type of an object, which can be leveraged by a remote attacker ...

PT-2026-93132

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description An observable discrepancy in Fonts allows a remote attacker to leak sensitive information. This is achieved by leveraging social engineering to entice a user to visit a crafted HTML pag...

PT-2026-93133

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A type confusion issue exists in the ServiceWorker component. This allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafte...