CVE Notifier

CVE-2026-82837 CWE-201 5.3

Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensi…

cve.org GitLab:GitLab 15 Sep 2026

CVE-2026-81236 CWE-434 8.6

CVE-2026-81236

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerab…

cve.org Dell:Wyse · Management · Suite 15 Sep 2026

CVE-2026-55374 CWE-74 4.8

canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, …

cve.org jleehr:canto-saas-api 15 Sep 2026

CVE-2026-18113 CWE-79 N/A

Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child …

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-11729 CWE-502 8.5

IBM MQ Java messaging is vulnerable to remote code execution

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authentic…

cve.org IBM:MQ 15 Sep 2026

CVE-2026-55375 CWE-209 5.3

canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST re…

cve.org jleehr:canto-saas-api 15 Sep 2026

CVE-2026-11864 CWE-643 6.5

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPa…

cve.org IBM:Cloud · Pak · for 15 Sep 2026

CVE-2026-81898 CWE-79 N/A

Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute s…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-61668 CWE-295 8.1

DIRAC: Pilot code downloaded over unverified HTTPS connection

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverifi…

cve.org DIRACGrid:DIRAC 15 Sep 2026

CVE-2026-11918 CWE-184 5.4

IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures

IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content.

cve.org IBM:ContextForge · MCP · Gateway 15 Sep 2026

CVE-2026-11921 CWE-522 N/A

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access containers may not apply management password change operations correctly.

cve.org IBM:Verify · Identity · Access 15 Sep 2026

CVE-2026-61667 CWE-89 9.9

DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated calle…

cve.org DIRACGrid:DIRAC 15 Sep 2026