CVE-2026-105857

Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload

CVE-2026-105859

Payload: Unauthorized update to collection documents

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload

CVE-2026-105863

Payload authentication token field handling issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload

CVE-2026-16340

IBM DataPower Gateway Out-of-bounds Write

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 and 2 more

CVE-2026-14991

IBM DataPower Gateway Out-of-bounds Write

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 and 2 more

CVE-2026-15762

IBM DataPower Gateway Out-of-bounds Write

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 and 2 more

CVE-2026-14269

IBM DataPower Gateway Buffer Overflow

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 and 2 more

CVE-2026-14502

IBM DataPower Gateway Improper Authentication

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 and 2 more

CVE-2026-82101

DataStage on Cloud Pak for Data Path Traversal

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datastage On Cloud Pak For Data

CVE-2026-82103

DataStage on Cloud Pak for Data Information Disclosure

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datastage On Cloud Pak For Data

CVE-2026-82110

DataStage on Cloud Pak for Data Path Traversal

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datastage On Cloud Pak For Data

CVE-2026-96119

IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-85440

MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.

CVSS 4.0 · 9.3 Critical EPSS 1.0% KEV · Not listed

Vendors

Themoos

Products

Core-moos

CVE-2026-85438

MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts

MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to write attacker-controlled doubles past the end of the IvPBox weight array, causing memory corruption and potential code execution.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85437

MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders

MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack buffers, potentially achieving remote code execution through MOOS variables or alog files.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85435

MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85434

MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2023-28531

openssh: smartcard keys to ssh-agent without the intended per-hop destination constraints.

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed

Vendors

Netapp Openbsd

Products

Brocade Fabric Operating System Hci Bootstrap Os Solidfire Element Os and 1 more

CVE-2023-27533

curl: TELNET option IAC injection

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Fedoraproject Haxx Netapp and 2 more

Products

Fedora Curl Active Iq Unified Manager and 12 more

CVE-2023-25139

glibc: incorrect printf output for integers with thousands separator and width field

sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed

Vendors

Gnu

Products

Glibc