CVE-2026-18104: Use of a Broken or Risky Cryptographic Algorithm

IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook ECB mode for encryption...

Ubuntu 20.04 LTS : urllib3 vulnerability (USN-8811-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8811-1 advisory. It was discovered that urllib3 did not correctly strip sensitive HTTP headers during cross-origin redirects. An attacker could possibly use this issue to leak...

PT-2026-97834

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Recursive copying of directories is permitted without proper controls, which may result in the unintentional inclusion of unnecessary or sensitive files and an increased attack surface...

CVE-2026-80423

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts...

CVE-2026-81208

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-81536 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

CVE-2026-81208 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-81208

The IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a critical flaw where the pull endpoint improperly handles encrypted credentials. The system decrypts {dsnextenc}/{encval} blobs using the cluster-wide DSNEXT_SEC_KEY and re-encrypts them under a caller-supplied AES key/IV. Because ...

WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by se1en in WordPress Plugin Spectra versions = 2.20.0...

CVE-2026-75887

A path traversal vulnerability exists in the OpenShift console within the i18n locale handler . An unauthenticated attacker can manipulate the lng and ns query parameters in the /locales/resource.json endpoint to read sensitive *.json files from the pod filesystem, such as configuration files and...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the actionGetResendModalContent process. An attacker can access sensitive submission data, including personally identifiable information, by invoking the control panel action without the required permissions...

CVE-2026-95600

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...

CVE-2026-95600

The WordPress TrustedLogin Connector plugin (versions

CVE-2026-95600 WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...

EUVD-2026-85503

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...

CVE-2026-95600 WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...

CVE-2026-92700 Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-92700 Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

EUVD-2026-85515

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-92700 Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...