CVE Notifier

CVE-2026-73496 CWE-22 7.7

MCP Atlassian: Arbitrary server-side file read via attachment upload

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file…

cve.org sooperset:mcp-atlassian 14 Sep 2026

CVE-2026-16432 CWE-611 7.7

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

cve.org IBM:DataStage · on · Cloud 14 Sep 2026

CVE-2026-16428 CWE-94 8.8

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

cve.org IBM:DataStage · on · Cloud 14 Sep 2026

CVE-2026-55093 CWE-125 6.1

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-con…

cve.org sonos:tract 14 Sep 2026

CVE-2026-90815 CWE-125 6.3

FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulati…

cve.org n/a:FFmpeg 14 Sep 2026

CVE-2026-16466 CWE-78 8.8

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.

cve.org IBM:DataStage · on · Cloud 14 Sep 2026

CVE-2026-16673 CWE-? 8.8

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.

cve.org IBM:DataStage · on · Cloud 14 Sep 2026

CVE-2026-16702 CWE-476 6.5

IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereferenc…

cve.org IBM:Db2 14 Sep 2026

CVE-2026-17047 CWE-352 5.4

IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.

cve.org IBM:Db2 · Mirror · for 14 Sep 2026

CVE-2026-17133 CWE-78 7.8

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

cve.org IBM:App · Connect · Enterprise 14 Sep 2026

CVE-2026-17156 CWE-502 7.8

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.

cve.org IBM:App · Connect · Enterprise 14 Sep 2026

CVE-2026-17463 CWE-400 6.5

IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource con…

cve.org IBM:Db2 14 Sep 2026