Threat database

CVE-2026-16706 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves an out-of-bounds write (CWE-787) that could be exploited remotely to cause a denial of service. The vulnerability does not impact confidentiality or integrity but can disrupt availability. No known exploits are reported in the wild, and no patch information is provided in the available data.

CVE-2026-16703 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves improper privilege management that could allow a local attacker with some privileges to escalate their privileges further. The vulnerability has a CVSS 3.1 score of 7.8, indicating a significant impact on confidentiality, integrity, and availability if exploited.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

CVE-2026-16686 is a high severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that involves improper authentication. This flaw could allow a remote attacker to access NFS-exported filesystems without proper authorization. The vulnerability has a CVSS 3.1 base score of 8.2, indicating a significant confidentiality impact. No patch or remediation information is currently provided.

CVE-2026-14970 is a high severity buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The issue causes the NIM server process to crash during client registration due to a buffer copy operation without checking the size of the input.

CVE-2026-16656 is a critical improper authentication vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to gain root privileges without proper authentication.

CVE-2026-15961 is a medium severity vulnerability in IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. It involves improper control of externally-controlled format strings, which could allow a local attacker with high privileges to obtain sensitive information or cause a denial of service. The vulnerability requires high attack complexity and privileges, with no user interaction needed.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.

CVE-2026-15068 is a critical OS command injection vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1 NIM. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements in OS commands.

CVE-2026-15065 is a critical vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM where intermediate certificate authority private keys are exposed in a publicly available update file. This cleartext storage of sensitive information could allow a remote attacker to bypass security restrictions.

CVE-2026-15061 is a path traversal vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 affecting the nimesis registration service. This flaw could allow a remote attacker to overwrite files on the affected system. The vulnerability has a high severity rating with a CVSS score of 8.2. No specific patch or remediation details are provided in the available data.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements used in an SQL command.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.