CVE Notifier

CVE-2026-18069 CWE-367 6.0

IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.

cve.org IBM:i 14 Sep 2026

CVE-2026-19273 CWE-287 5.4

The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access Control

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 Standard Edition could allow a rem…

cve.org IBM:Sterling · B2B · Integrator 14 Sep 2026

CVE-2026-19086 CWE-125 3.3

IBM i is Affected By Multiple Vulnerabilities in PASE [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

cve.org IBM:i 14 Sep 2026

CVE-2026-90824 CWE-121 3.3

GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow

A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The …

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-19280 CWE-787 5.2

IBM i is Affected By Multiple Vulnerabilities in PASE [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

cve.org IBM:i 14 Sep 2026

CVE-2026-90896 CWE-306 N/A

Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Tem…

cve.org MarcosCamara01:Ecommerce · Template 14 Sep 2026

CVE-2026-19290 CWE-284 7.5

IBM Sterling File Gateway is Vulnerable to Improper Access Control

IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.

cve.org IBM:Sterling · File · Gateway 14 Sep 2026

CVE-2026-75792 CWE-285 4.3

IBM Sterling Secure Proxy is vulnerable to multiple issues

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass.

cve.org IBM:Sterling · Secure · Proxy 14 Sep 2026

CVE-2026-78415 CWE-79 5.4

IBM Sterling Secure Proxy is vulnerable to multiple issues

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup.

cve.org IBM:Sterling · Secure · Proxy 14 Sep 2026

CVE-2026-7884 CWE-79 5.4

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses t…

cve.org IBM:Cognos · Analytics 14 Sep 2026

CVE-2026-68489 CWE-96 N/A

CVE-2026-68489

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

cve.org WebPros:Plesk · extension · "Ruby" 14 Sep 2026

CVE-2026-67399 CWE-502 N/A

CVE-2026-67399

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

cve.org WebPros:WHMCS 14 Sep 2026