Threats affecting pkg:maven/ibm/i

CVE-2026-17502 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves an out-of-bounds write that could be exploited remotely to cause a denial of service. The vulnerability does not require user interaction or privileges to exploit. No official patch or remediation information is currently available.

CVE-2026-17101 is a high-severity vulnerability in IBM i versions 7.3 through 7.6 that involves improper authentication. This flaw could allow a remote attacker to execute arbitrary code or access sensitive information. The vulnerability has a CVSS score of 8.3, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability that could allow a remote attacker to cause a denial of service by exhausting system resources. This issue is categorized as CWE-400, indicating uncontrolled resource consumption. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.

CVE-2026-16878 is an out-of-bounds read vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a medium severity with a CVSS score of 5.4. No official patch or remediation guidance has been provided yet.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input.

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation.