CVE-2026-16822

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 have improper certificate validation allowing a remote attacker (no auth needed) to impersonate the TNC policy server and modify traffic; CVSS 9.3 Critical. IBM support page linked as reference; no patch or exploit details provided in documents.

EUVD-2026-62705

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation...

CVE-2026-72497

A flaw was found in the RDMA/bnxtre component of the Linux kernel. This vulnerability arises from insufficient validation of the Work Queue Entry WQE mode, which dictates how tasks are managed, against the hardware's defined slot limits. A local attacker could exploit this by supplying an invalid...

CVE-2026-16835 Power System Improper Certificate Validation

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...

CVE-2026-19234

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image,...

CVE-2026-19234 Power System Buffer Overflow

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image,...

CVE-2026-19234

IBM Power Systems firmware (FW1120.00, FW1110.00–.30, FW1060.00–.80) suffers CWE-121 stack-based buffer overflow in the host boot image validation path. An attacker with service processor access can inject a malicious code update image, achieving arbitrary host code execution with HIGH confidenti...

CVE-2026-72410

A flaw was found in the Linux kernel's octeontx2-af driver. This vulnerability stems from an incorrect validation check when setting the maximum number of NIX Logical Functions LFs using the devlink command. An attacker could potentially exploit this to configure the system in an unintended state...

CVE-2026-74460

A flaw was found in the Linux kernel's emsusb module. This vulnerability occurs because the emsusbreadbulkcallback function, which processes Controller Area Network CAN Protocol Converter CPC messages from a USB receive buffer, does not properly validate the lengths of these messages. An attacker...

CVE-2026-20318

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20314

A vulnerability in Cisco Packaged Contact Center Enterprise Packaged CCE and Cisco Unified Contact Center Enterprise Unified CCE could allow an authenticated, remote attacker to conduct server-side request forgery SSRF attacks through an affected device. This vulnerability is due to improper inpu...

CVE-2026-20232

A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

CVE-2026-72344

A flaw was found in the Linux kernel's net/mlx5e driver. When the mlx5laggetdevseq function encounters an error, such as a peer not being in the Link Aggregation Group LAG or no master device being marked, the system attempts to clean up peer flows without proper validation. This improper handlin...

MINI-P7W5-G4R5-PVW6

Bulletin has no description...

EUVD-2026-62585

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...

CVE-2026-20327 Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-20327

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

EUVD-2026-62576

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-20314 Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability

A vulnerability in Cisco Packaged Contact Center Enterprise Packaged CCE and Cisco Unified Contact Center Enterprise Unified CCE could allow an authenticated, remote attacker to conduct server-side request forgery SSRF attacks through an affected device. This vulnerability is due to improper inpu...

CVE-2026-20314

Cisco Packaged CCE and Unified CCE are vulnerable to SSRF due to improper input validation of specific HTTP requests. An authenticated, remote attacker with valid credentials can send crafted HTTP requests that cause the device to issue arbitrary network requests. CVSS 5.0 (MEDIUM) limits impact ...