CVE-2026-17481 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs...

CVE-2026-17481

IBM Documentation Offline (1.0.0–1.4.1), an Electron/Node.js desktop app, has CWE-117: improper log output neutralization allowing remote code execution (CVSS 8.8). The embedded server binds to all network interfaces. IBM recommends upgrading to 1.5.1; no workaround is available. No in-the-wild e...

CVE-2026-17473 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-17473

IBM Documentation Offline 1.0.0–1.4.1 is affected by CVE-2026-17473: information disclosure via path traversal caused by improper limitation of a pathname to a restricted directory. A remote attacker could read arbitrary files. CVSS v3.1 base score 7.5 (HIGH). Remediation: upgrade to 1.5.1.

CVE-2026-17473 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-17468 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-17468

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-17468 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-17468

CVE-2026-17468 affects IBM Documentation Offline (versions 1.0.0–1.4.1). The embedded server uses a hardcoded session secret, enabling a remote attacker to forge valid session tokens and manipulate client-side state (session forgery). This is part of multiple vulnerabilities in the IBM Documentat...

EUVD-2026-58454

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-49864

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string escapeMarkup: false. Any output the victim renders - a cat'd file, a tailed log,...

CVE-2026-17045

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

CVE-2026-19748

CVE-2026-19748 affects Tenda CH7/CH7G/CH10/CP3/CP3 Pro/CP7/TC3B14C/TC3B15C/TC3T14C/TC3T15C. The vulnerability concerns the function CWebSessionManager_ParseSession in the Kylin Web Service, specifically in the file /user/bin/Kylin. The issue is described as leading to insufficient entropy in the ...

CVE-2026-19748 Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManagerParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument...

EUVD-2026-58391

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManagerParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument...

CVE-2026-19748

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManagerParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument...

CVE-2026-17045

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

EUVD-2026-58388

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

CVE-2026-17045

CVE-2026-17045 affects IBM i 7.6, 7.5, 7.4, and 7.3 due to improper session management that can allow a remote authenticated attacker to perform unauthorized operations and access sensitive information. The vulnerability is categorized under CWE-294 (Authentication Bypass by Capture-replay) with ...

CVE-2026-17045 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...