CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

CVE-2026-18249

IBM i 7.3–7.6 is vulnerable to privilege escalation via improper pointer validation from Java-controlled addresses (CWE-269), requiring a remote authenticated attacker with low privileges. IBM provides PTFs for all affected releases (e.g., SJ11037 for 7.6); no workarounds are available. No exploi...

CVE-2026-18193 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses...

CVE-2026-18193

CVE-2026-18193 affects IBM i versions 7.3, 7.4, 7.5, and 7.6, specifically the IBM SDK Java Technology Edition and IBM Runtime Environment Java components. The root cause is improper validation of user-controlled addresses (CWE-269: Improper Privilege Management), allowing a remote attacker to by...

EUVD-2026-58467

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses...

EUVD-2026-58453

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens...

CVE-2026-72660

Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data...

CVE-2026-18846

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server DoS for that server...

CVE-2026-16987

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable...

CVE-2026-17069

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-16987

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable...

CVE-2026-16987

CVE-2026-16987 affects IBM i 7.6, 7.5, 7.4, and 7.3 with a local privilege escalation due to improper validation of the LANG environment variable in Portable Application Solutions Environment (PASE). The root cause is the environment variable handling, enabling a local attacker to gain elevated p...

EUVD-2026-58385

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable...

CVE-2026-16898

CVE-2026-16898 affects IBM i 7.3–7.6 and can allow a local authenticated attacker to change ownership of arbitrary files due to improper validation of attacker-controlled file paths (CWE-73). The issue is documented in IBM’s Security Bulletin for Network Authentication Service, which confirms the...

CVE-2026-16898

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

EUVD-2026-58379

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-16898 IBM i is Affected By Multiple Vulnerabilities in Network Authentication Service

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

MINI-WVPV-Q8HM-RH65

Bulletin has no description...

EUVD-2026-58223

Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected...

CVE-2026-72660

Kibana is affected by CVE-2026-72660 due to an Uncaught Exception (CWE-248) from Improper Input Validation (CWE-20) that can cause a Denial of Service (CAPEC-153). An authenticated Kibana account with at least read access and the ability to write to an Elasticsearch index can trigger an internal ...