CVE Notifier

CVE-2026-17416 CWE-502 7.8

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.

cve.org IBM:App · Connect · Enterprise 14 Sep 2026

CVE-2026-17467 CWE-327 8.2

Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols.

cve.org IBM:Cloud · Pak · for 14 Sep 2026

CVE-2026-17628 CWE-287 5.4

Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.

cve.org IBM:Langflow · OSS 14 Sep 2026

CVE-2026-18065 CWE-290 5.3

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.

cve.org IBM:i 14 Sep 2026

CVE-2026-18251 CWE-1385 4.3

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.

cve.org IBM:i 14 Sep 2026

CVE-2026-16148 CWE-666 4.6

Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx2_enable() (the driver's .enable op) in drivers/us…

cve.org zephyrproject:zephyr 14 Sep 2026

CVE-2026-16147 CWE-416 6.8

it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the active transfer buffer is obtained with udc_buf_peek(…

cve.org zephyrproject:zephyr 14 Sep 2026

CVE-2026-15924 CWE-416 5.9

Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and rea…

cve.org zephyrproject:zephyr 14 Sep 2026

CVE-2026-90814 CWE-918 6.3

cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery

A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of…

cve.org cosmicstack-labs:mercury-agent 14 Sep 2026

CVE-2026-19624 CWE-88 7.8

NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unpr…

cve.org Fedora:Fedora · Fedora:Extra · Packages 14 Sep 2026

CVE-2026-90813 CWE-180 4.3

cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulati…

cve.org cosmicstack-labs:mercury-agent 14 Sep 2026

CVE-2026-82049 CWE-59 N/A

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions…

cve.org Python · Software · Foundation:CPython 14 Sep 2026