CVE-2026-84106

IBM Guardium Data Protection 12.2 is affected by a vulnerability that could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation . The CVSS v3.1 score is 8.9 (HIGH) , with a changed scope and high impact on both confide...

CVE-2026-84105

IBM Guardium Data Protection 12.2 is affected by a SQL injection vulnerability (CWE-89) caused by improper neutralization of special elements in an SQL command. A remote authenticated attacker can exploit this to obtain sensitive information across a security boundary (scope: changed), with a HIG...

CVE-2026-63646

CordysCRM , an open-source AI-powered CRM supporting private deployment, exposed the GET /mcp/form/config/{formKey} endpoint to unauthenticated access prior to version 1.7.2 . The root cause is twofold: ShiroFilter.addPublicPathFilters marks all /mcp/** paths as anonymous, and the McpController l...

CVE-2026-84089

IBM Guardium Data Protection 12.2 is vulnerable to improper privilege management (CWE-269), allowing a local attacker with low privileges to gain elevated privileges on the system. The vulnerability requires local access with low privilege level and low attack complexity, yielding a CVSS 3.1 scor...

CVE-2026-84086

CVE-2026-84086 affects IBM Guardium Data Protection 12.2 and is a path traversal vulnerability (CWE-22) caused by improper limitation of a pathname to a restricted directory. A remote authenticated attacker with high privileges can exploit this to execute arbitrary code , resulting in high impact...

CVE-2026-52745

CordysCRM , an open-source AI-powered CRM supporting private deployment, is vulnerable to a time-based blind SQL injection in the POST /account-pool/page endpoint prior to version 1.7.0 . An authenticated user holding the MODULE_SETTING:UPDATE permission can craft a sort.name value that is inject...

CVE-2026-84085

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection due to improper neutralization of special elements in OS commands, allowing a remote attacker to execute arbitrary OS commands. The CVSS v3.1 score is 8.1 (HIGH) with a network attack vector, high complexity, no privileges re...

CVE-2026-84084

IBM Guardium Data Protection 12.2 is vulnerable to cross-site request forgery (CSRF) (CWE-352), allowing a remote unauthenticated attacker to bypass security restrictions when a user interacts with a crafted request. The CVSS 3.1 score is 8.8 (High) with impacts to confidentiality, integrity, and...

CVE-2026-84083

IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. The root cause is insufficient argument validation in the SUID binary, allowing a local attacker with low-privileged access to execute arbitrary comman...

CVE-2026-84082

IBM Guardium Data Protection 12.2 is affected by a SQL injection vulnerability (CWE-89) caused by improper neutralization of special elements used in an SQL command. A remote unauthenticated attacker can exploit this to execute arbitrary SQL commands, with full impact on confidentiality, integrit...

CVE-2026-61819

pg_partman is a PostgreSQL extension for managing partitioned tables. Prior to 5.5.0 , when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions embed p_parent_table verbatim inside a SQL string literal passed to pg_jobmon.add_job(). A partman...

CVE-2026-61820

CVE-2026-61820 affects pg_partman , a PostgreSQL extension for managing partitioned tables. The vulnerability lies in the inherit_template_properties() function, which surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters...

CVE-2026-84081

IBM Guardium Data Protection 12.2 is affected by a vulnerability caused by improper certificate validation , which could allow a remote attacker to bypass security restrictions. The attack requires no prior authentication or user interaction but carries high complexity , as indicated by the CVSS ...

CVE-2026-84078

IBM Guardium Data Protection 12.2 contains a missing authentication flaw (CWE-306) in the LoadBalancerServlet , rated CVSS 9.9 (CRITICAL) . An unauthenticated remote attacker can access privileged load-balancer operations, potentially performing unauthorized actions that impact the integrity and ...

CVE-2026-61817

pg_partman is a PostgreSQL extension for managing partitioned tables by time or ID. Prior to 5.5.0 , the functions run_maintenance() , show_partitions() , show_partition_info() , undo_partition() , and partition_data_time() interpolate the writable part_config.time_dncoder text value without iden...

CVE-2026-84077

IBM Guardium Data Protection 12.2 is affected by a cross-site request forgery (CSRF) vulnerability (CWE-352) that allows a remote attacker with no privileges to bypass security restrictions, provided the victim performs a user action. The CVSS 3.1 score is 8.1 (HIGH) , with impact on integrity an...

CVE-2026-84076

IBM Guardium Data Protection 12.2 is affected by an improper authorization flaw that could allow a remote authenticated attacker to bypass security restrictions . The vulnerability requires low privileges and is exploitable over the network without user interaction, resulting in high impact on in...

CVE-2026-61818

pg_partman , a PostgreSQL extension for managing partitioned tables, is affected by an SQL injection in the undo_partition() function. Prior to version 5.5.0 , the function reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically execut...

CVE-2026-84075

IBM Guardium Data Protection 12.2 is affected by a missing authentication vulnerability in the ChangeTrackerServlet component, allowing a remote, unauthenticated attacker to bypass security restrictions . The vulnerability is rated CVSS 9.9 (Critical) with a changed scope and high integrity impac...

CVE-2026-61821

CVE-2026-61821 affects the pg_partman PostgreSQL extension (which manages partitioned tables by time or ID). Prior to 5.5.0 , the functions drop_partition_id() and drop_partition_time() accept any nonempty value from part_config.retention_schema as the target for ALTER TABLE SET SCHEMA. A role wi...