CVE Notifier

CVE-2026-47253 CWE-22 7.3

Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join t…

cve.org julien040:anyquery 14 Sep 2026

CVE-2026-16187 CWE-862 6.5

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request.

cve.org IBM:WebSphere · Application · Server 14 Sep 2026

CVE-2026-18119 CWE-79 N/A

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values

Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script…

cve.org Concrete · CMS:Concrete · CMS 14 Sep 2026

CVE-2026-54447 CWE-732 8.4

garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json wi…

cve.org cyberjunky:python-garminconnect 14 Sep 2026

CVE-2026-16188 CWE-117 5.3

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

cve.org IBM:WebSphere · Application · Server 14 Sep 2026

CVE-2026-55209 CWE-120 9.8

resdata insufficiently validates untrusted GRDECL files

resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while pars…

cve.org equinor:resdata 14 Sep 2026

CVE-2026-16190 CWE-862 3.1

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.

cve.org IBM:WebSphere · Application · Server 14 Sep 2026

CVE-2026-16189 CWE-117 4.8

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

cve.org IBM:WebSphere · Application · Server 14 Sep 2026

CVE-2026-73497 CWE-918 6.5

MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-C…

cve.org sooperset:mcp-atlassian 14 Sep 2026

CVE-2026-16335 CWE-22 8.1

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability.

cve.org IBM:DataStage · on · Cloud 14 Sep 2026

CVE-2026-16338 CWE-73 9.9

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.

cve.org IBM:DataStage · on · Cloud 14 Sep 2026

CVE-2026-16435 CWE-650 5.9

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.

cve.org IBM:WebSphere · Application · Server 14 Sep 2026