CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-80117 PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sys

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist...

CVE-2026-80114 PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

CVE-2026-80112 PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...

CVE-2026-78327

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...

CVE-2026-53761 Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0...

CVE-2026-61614 SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

CVE-2026-85769 Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

CVE-2026-85656 OS command injection in Amazon log4j-cve-2021-44228-hotpatch

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters...

CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-18149 undici vulnerable to Denial of Service via orphaned RetryHandler response body

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status...

CVE-2026-18540 undici vulnerable to downstream response splitting via retry interceptor

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume...

CVE-2026-57163 PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend

PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate tlscertgetinfo in sslsockgtls.c. Only GnuTLS builds are affect...

CVE-2026-57162 PJSIP: Stack overflow parsing SDP a=crypto attributes

PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer sdesencodesdp in transportsrtpsdes.c. This affects applications with...

CVE-2026-85654 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84947 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-14350 Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-16180 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities...

CVE-2026-16693 IBM i is Affected By Cryptographic Algorithm Weakness in DCM []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys...

CVE-2026-16892 IBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching...

CVE-2026-17207 IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow...

CVE-2026-17259 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow...

CVE-2026-17440 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to cause a denial of service due to uncontrolled recursion...

CVE-2026-17443 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection flaw...

CVE-2026-17470 IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow...

CVE-2026-17499 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17627 Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...

CVE-2026-18073 IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements...

CVE-2026-18078 IBM i is Affected By Denial of Service Vulnerability in Save Restore []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow...

CVE-2026-18341 IBM i is Affected By Buffer Overflow Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow...

CVE-2026-18489 IBM ContextForge Translate is affected by cross-client credential context confusion

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-18567 IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...

CVE-2026-18887 IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about process they shouldn't be permitted to access...

CVE-2026-19301 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-18905 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-19274 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19300 Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...

CVE-2026-19302 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-82911 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-44402 Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a...

CVE-2026-19305 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-19306 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute pat...

CVE-2026-5522 QRadar contains hard-coded credentials

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

CVE-2026-77822 IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...

CVE-2026-78543 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop...