Search vulnerabilities

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,898

CVE-2026-80412

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-80425

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-80423

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-81208

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-81536

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-81537

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-81539

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-81545

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-81547

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-98182

wifi: mac80211: refuse to make a monitor active when it has no queue

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver is handed a monitor with no queue. ath9k dereferences it: BUG: kernel NULL pointer dereference, address: 0000000000000066 RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k] ath9k_add_interface+0x10c/0x140 [ath9k] drv_add_interface+0x54/0x250 [mac80211] ieee80211_do_open+0x32f/0x800 [mac80211] Reached with CAP_NET_ADMIN by "iw dev X set monitor active" followed by "ip link set X up". RTNL is held, so netlink operations block behind it. Refuse the flag when there is no queue to give.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-98183

wifi: mac80211: avoid out-of-bounds read for empty PREQ elements

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload. Move the helper call after both size checks, so the bottom fields are only accessed when they are present.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-98187

wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST The PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if from it. A truncated trailing record makes the if_id/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak. Advance only while a full record still fits in the entry.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-98204

Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

In the Linux kernel, the following vulnerability has been resolved: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() When chunking writes into SMBus blocks in rmi_smb_write_block(), the loop calculates block_len using the original total length (len) instead of the remaining length (cur_len). If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32 for every iteration, even on the final partial chunk where fewer than 32 bytes remain. This causes smb_block_write() to read 32 bytes from the advanced data buffer pointer, reading past the end of the input buffer. Fix this by calculating block_len using cur_len and advancing the buffer and address pointers by block_len.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-98196

wifi: brcmsmac: fix UAF in brcms_free_timer()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcms_free_timer() brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of(). Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-98202

Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Transport drivers (such as rmi_i2c and rmi_spi) invoke rmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev device during system power management events. However, transport drivers are fully registered and operational even if the physical RMI driver failed to bind or probe the rmi_dev device. When rmi_driver_suspend() or rmi_driver_resume() is called on an unbound rmi_dev, dev_get_drvdata() returns NULL. Calling rmi_disable_irq() or rmi_enable_irq() without driver data attached causes a NULL pointer dereference and General Protection Fault when attempting to lock data->enabled_mutex. Fix this by checking if driver data is attached to rmi_dev in rmi_driver_suspend() and rmi_driver_resume(), exiting early if no driver data is present.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-98232

scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed buf_data can point beyond buf. During automatic scan, enable is false, so the read-modify-write of buf_data[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsi_mode_select() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target. This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required. On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled. The issue was independently found during security research at Drivesec S.r.l. Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-16335

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-16338

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-81447

Improper Certificate Validation in Dell OpenManage Server Administrator Leading to Information Disclosure

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Dell Openmanage Server Administrator Managed Node For Rhel 8.10 Dell Openmanage Server Administrator Managed Node For Rhel 9.4 Dell Openmanage Server Administrator Managed Node For Sles 15 and 3 more
CVE-2026-16428

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data