CVE-2026-17122

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain a stack-based buffer overflow exploitable remotely without authentication, rated CVSS 9.8 CRITICAL (C/I/A high). IBM has published advisory https://www.ibm.com/support/pages/node/7283858. No exploit code or active exploitation is reported in the provid...

CVE-2026-17040

CVE-2026-17040 is a stack-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 that allows a remote attacker to execute arbitrary code without authentication or user interaction. The CVSS 3.1 score is 9.8 (Critical) with a network attack vector and full impact on confidentiality, in...

CVE-2026-17024

CVE-2026-17024 affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 , where improper certificate validation allows a remote, unauthenticated attacker to execute arbitrary code. NVD scores it 9.8 (CRITICAL) with a network vector, low complexity, and no privileges or user interaction required, whil...

CVE-2026-17006 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow...

CVE-2026-17000

CVE-2026-17000 affects IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 , where an improper authentication flaw allows a remote attacker to execute arbitrary code. NVD scores it 9.8 (Critical) ; IBM's CNA assigns 8.1 (High) , citing higher attack complexity. CISA's SSVC assessment indicates no known expl...

CVE-2026-17000 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper authentication...

CVE-2026-69555 Azure Arc Elevation of Privilege Vulnerability

...

CVE-2026-69419 Azure Data Manager for Energy Remote Code Execution Vulnerability

...

CVE-2026-69419

An integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code remotely. Microsoft's update guide is the reference; no specific affected version, patch, or exploit details are provided in the documents.

CVE-2026-69419 Azure Data Manager for Energy Remote Code Execution Vulnerability

...

CVE-2026-65770 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

...

CVE-2026-65770

Azure Managed Instance for Apache Cassandra is affected by an argument injection vulnerability (improper neutralization of argument delimiters in a command) that allows an unauthorized attacker to execute code over a network without any privileges or user interaction. The CVSS 3.1 score is 10.0 (...

CVE-2026-65770 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

...

CVE-2026-69836 Microsoft Entra ID Remote Code Execution Vulnerability

...

CVE-2026-69836

CVE-2026-69836 is a CVSS 10.0 (Critical) deserialization of untrusted data vulnerability in Microsoft Entra ID (formerly Azure Active Directory), enabling an unauthorized attacker to achieve remote code execution over a network with no privileges or user interaction required. The vulnerability wa...

CVE-2026-69836 Microsoft Entra ID Remote Code Execution Vulnerability

...

CVE-2026-55765

CloudNativePG (a Kubernetes-based PostgreSQL management platform) prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword and appendPasswordOption. When pg_stat_statements was preloaded with track_utility enabled, an untru...

EUVD-2026-63685

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-55765 CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...