🚨 CVE-2026-72686
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.
🎖@cveNotify
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.
🎖@cveNotify
Discuss the Elastic Stack
Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-78)
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input…
🚨 CVE-2026-72687
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.
🎖@cveNotify
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.
🎖@cveNotify
Discuss the Elastic Stack
Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-79)
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and…
🚨 CVE-2026-17071
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17088, CVE-2026-17075, CVE-2026-17071, CVE-2026-17069, CVE-2026-17045, CVE-2026-17043] in Digital Certificate Manager (DCM) as described in the vulnerability details section.
🚨 CVE-2026-17074
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17216, CVE-2026-17076, CVE-2026-17077, CVE-2026-17074] in Distributed Relational Database Architecture (DRDA) / Distributed Data Management (DDM) as described in the vulnerability details section.
🚨 CVE-2026-17075
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17088, CVE-2026-17075, CVE-2026-17071, CVE-2026-17069, CVE-2026-17045, CVE-2026-17043] in Digital Certificate Manager (DCM) as described in the vulnerability details section.
🚨 CVE-2026-17076
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM resynchronization requests.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM resynchronization requests.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17216, CVE-2026-17076, CVE-2026-17077, CVE-2026-17074] in Distributed Relational Database Architecture (DRDA) / Distributed Data Management (DDM) as described in the vulnerability details section.
🚨 CVE-2026-17077
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17216, CVE-2026-17076, CVE-2026-17077, CVE-2026-17074] in Distributed Relational Database Architecture (DRDA) / Distributed Data Management (DDM) as described in the vulnerability details section.
🚨 CVE-2026-17078
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM [CVE-2026-17078]
IBM i is vulnerable to a denial of service due to resource exhaustion [CVE-2026-17078] in Distributed Relational Database Architecture (DRDA) / Distributed Data Management (DDM) as described in the vulnerability details section.
🚨 CVE-2026-17088
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-17088, CVE-2026-17075, CVE-2026-17071, CVE-2026-17069, CVE-2026-17045, CVE-2026-17043] in Digital Certificate Manager (DCM) as described in the vulnerability details section.
🚨 CVE-2026-17099
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i is vulnerable to multiple vulnerabillities [CVE-2026-16694, CVE-2026-17101, CVE-2026-17099, CVE-2026-16904, CVE-2026-17095, CVE-2026-17094, CVE-2026-17268, CVE-2026-17266, CVE-2026-17276, CVE-2026-18099, CVE-2026-18098, CVE-2026-18235, CVE-2026-18713…
🚨 CVE-2026-17101
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i is vulnerable to multiple vulnerabillities [CVE-2026-16694, CVE-2026-17101, CVE-2026-17099, CVE-2026-16904, CVE-2026-17095, CVE-2026-17094, CVE-2026-17268, CVE-2026-17266, CVE-2026-17276, CVE-2026-18099, CVE-2026-18098, CVE-2026-18235, CVE-2026-18713…
🚨 CVE-2026-17212
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-16858, CVE-2026-16867, CVE-2026-16868, CVE-2026-16853, CVE-2026-17226, CVE-2026-16859, CVE-2026-16878, CVE-2026-16861, CVE-2026-17212, CVE-2026-18020, CVE-2026-17649, CVE-2026-16871, CVE-2026-18671…
🚨 CVE-2026-17226
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-16858, CVE-2026-16867, CVE-2026-16868, CVE-2026-16853, CVE-2026-17226, CVE-2026-16859, CVE-2026-16878, CVE-2026-16861, CVE-2026-17212, CVE-2026-18020, CVE-2026-17649, CVE-2026-16871, CVE-2026-18671…
🚨 CVE-2026-17272
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By a Denial of Service in HTTP Server [CVE-2026-17272]
IBM i is vulnerable to a denial of service from an out-of-bounds write [CVE-2026-17272] in HTTP Server as described in the vulnerability details section.
🚨 CVE-2026-17438
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP [CVE-2026-17438]
IBM i is vulnerable to obtaining sensitive information or modifying data due to improper privilege management [CVE-2026-17438] in Lightweight Directory Access Protocol (LDAP) as described in the vulnerability details section.
🚨 CVE-2026-17468
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.
🎖@cveNotify
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.
🎖@cveNotify
Ibm
Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server…
🚨 CVE-2026-17473
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
🎖@cveNotify
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
🎖@cveNotify
Ibm
Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server…
🚨 CVE-2026-17476
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.
🎖@cveNotify
Ibm
Security Bulletin: IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime
IBM i is vunlerable to multiple vulnerabilities [CVE-2026-18193, CVE-2026-18249, CVE-2026-17476] in IBM SDK Java Technology Edition and IBM Runtime Environment Java to support the building and running of Java applications as described in the vulnerability…
🚨 CVE-2026-17481
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
🎖@cveNotify
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
🎖@cveNotify
Ibm
Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server…
🚨 CVE-2026-17482
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
🎖@cveNotify
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
🎖@cveNotify
Ibm
Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server…
🚨 CVE-2026-17502
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
🎖@cveNotify
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
🎖@cveNotify
Ibm
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i is vulnerable to multiple vulnerabilities [CVE-2026-16858, CVE-2026-16867, CVE-2026-16868, CVE-2026-16853, CVE-2026-17226, CVE-2026-16859, CVE-2026-16878, CVE-2026-16861, CVE-2026-17212, CVE-2026-18020, CVE-2026-17649, CVE-2026-16871, CVE-2026-18671…