IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a vulnerability due to improper handling of malformed frames, which can cause a denial of service by terminating the host process. This issue is identified as CWE-130, involving length parameter inconsistency. The vulnerability has a high severity with a CVSS score of 7.5.
IBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 contain a vulnerability due to uncontrolled recursion that can be exploited remotely to cause a denial of service. This vulnerability does not impact confidentiality or integrity but results in service disruption.
A vulnerability in the codefori vscode-ibmi Visual Studio Code extension prior to version 3.0.1 allows insecure handling of temporary files. Specifically, Object Browser downloads and edit-save flow content are stored in the shared /tmp directory without reliable cleanup, potentially exposing file contents to other local users on the system. This issue is resolved in version 3.0.1.
CVE-2026-49483 is a high-severity vulnerability in the codefori vscode-ibmi Visual Studio Code extension prior to version 3.0.1. The issue involves incorrect permission assignment for IBMi components, allowing local accounts to alter programs due to broad public permissions and insufficient integrity verification. The vulnerability is fixed in version 3.0.1.
CVE-2026-53922 is a stack-based buffer overflow vulnerability in the odhcpd DHCP server component of OpenWrt. It allows an unauthenticated attacker on the same network link to send crafted DHCPv6 RENEW messages with multiple IA_NA options, triggering a buffer overflow in the server's stack buffer. This overflow leads to process termination via stack canary detection, causing denial of service by repeatedly disrupting DHCPv6 service. No code execution has been observed from this vulnerability.
CVE-2026-108932 is a cross-site scripting (XSS) vulnerability in Netcore NR268 version 1.7.121109. The flaw exists in the eval function of the file filter_hosts_dump.cgi within the DHCP Hostname Handler component. An attacker can manipulate the Hostname argument to execute arbitrary scripts remotely. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a patch. The CVSS 4.0 score rates this as a medium severity issue.
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.
GNU Aspell version 0.60.8.2 contains a heap-based buffer overflow vulnerability in its read-only dictionary loader. The flaw arises from improper handling of size fields in a .rws dictionary header, allowing crafted dictionary files to trigger out-of-bounds writes. This can lead to heap memory corruption, causing denial of service or potentially arbitrary code execution. The issue is fixed in a commit identified as b830b6e and will be addressed in release 0.60.8.3.
CVE-2026-84312 is an improper authentication vulnerability in the Casdoor SSO flow of 0xJacky nginx-ui. The OAuth state parameter is hard-coded and not validated against a per-session value, enabling login CSRF attacks. An attacker can force a victim's browser to authenticate as the attacker, potentially leading to unauthorized access and data exfiltration. The vulnerability affects versions prior to 2.4.1. A patch is available that implements proper state parameter generation and validation similar to the OIDC flow.
CVE-2026-84360 is an authentication bypass vulnerability in 0xJacky's nginx-ui product that allows OTP-enabled users to bypass the intended secure session requirement for high-impact Nginx configuration changes. The vulnerability arises because the MCP endpoints, which allow configuration mutations, require only ordinary authentication rather than the stricter secure session. This enables an attacker with valid JWT authentication but without a secure session to modify Nginx configuration via the /mcp and /mcp_message endpoints. The issue was verified with a proof-of-concept demonstrating successful configuration changes without step-up authentication.
CVE-2026-84316 is an improper input validation vulnerability in 0xJacky's nginx-ui that allows authenticated users to bypass directive validation by placing blocked directives after a semicolon on the same line. This bypass affects all guarded write paths that call the validator, enabling injection of dangerous nginx directives such as js_import, load_module, and user root. On deployments with njs or perl modules enabled, this leads to code execution in the nginx worker process, potentially as root. The vulnerability requires authentication via node secret or user JWT and has been demonstrated on version 2.3.11 of the official Docker image. The issue stems from the validator splitting config content by newlines and only inspecting the first token per line, while nginx parses multiple directives separated by semicolons on the same line.
CVE-2026-84319 is a vulnerability in 0xJacky's nginx-ui that allows a secondary authenticated user to bypass restricted directive validation in the MCP configuration interface. While the HTTP API blocks restricted Nginx directives such as load_module, js_import, and js_content, the MCP interface permits writing and applying equivalent restricted configurations. This enables execution of attacker-controlled NJS scripts within the Nginx worker context, potentially modifying runtime behavior including responses and routing. The vulnerability affects versions prior to 2.4.1. The CVSS score is 8.3 (high severity).
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain an improper access control vulnerability due to a schema-less Custom Resource Definition. This flaw allows improper privilege management, potentially leading to unauthorized access. The vulnerability has a high severity with a CVSS score of 7.2.
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain an improper access control vulnerability due to a misconfigured Kubernetes NetworkPolicy. This vulnerability allows unintended network egress, potentially exposing sensitive data or services. The issue has a high severity rating with a CVSS score of 7.7, indicating significant confidentiality impact but no integrity or availability impact.
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a command injection vulnerability due to improper sanitization of user-controlled input passed to a shell command in a Kubernetes operator task. This vulnerability allows an attacker with high privileges to execute arbitrary commands on the affected system. The vulnerability has a high severity with a CVSS score of 8.7.
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a vulnerability related to improper input validation. This is due to an unsanitised container image configuration in a Kubernetes operator template, which can lead to code injection. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. There is no information on available patches or vendor advisories specifying remediation. No known exploits are reported in the wild.
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a vulnerability due to improper input validation of a container image reference in a Kubernetes operator template. This unsanitized input can lead to code injection issues.
IBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 contain a vulnerability that allows a remote attacker to cause a denial of service via an infinite parsing loop when processing certain inputs. This vulnerability is classified as CWE-400, indicating uncontrolled resource consumption. The issue can be exploited without authentication and requires no user interaction.
CVE-2026-78673 is a high severity vulnerability in IBM Maximo AI Service versions 9.1.0 and 9.2.0. It involves improper input validation that could allow a remote attacker to cause a denial of service (DoS). No confidentiality or integrity impact is reported. There are no known exploits in the wild, and no patch information is provided.
CVE-2026-105052 is a path traversal vulnerability in IBM Maximo Application Suite versions 8.10, 8.11, 9.0, 9.1, and 9.2. It allows a remote attacker to send specially crafted URL requests containing directory traversal sequences (/../) to access arbitrary files on the system. This vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation information is provided in the available data.