CVE Vulnerabilities - 8 October 2026

Microsoft Partner Center lets attacker gain higher rights

CVE-2026-96207

The Microsoft Partner Center web service does not correctly check digital certificates, so a malicious person could trick the system and increase their access level. This could let them view or change...

10.0

NetBoard CRM demo can let attackers read or change data

CVE-2026-12260

The demo version of NetBoard CRM has a flaw in the password‑recovery page that lets a remote user send specially crafted input and view or modify information stored in the system. This could expose de...

10.0

vm2 library can let attackers run code

GHSA-47x8-96vw-5wg6 CVE-2026-43997 ROOT-APP-NPM-CVE-2026-43997

The vm2 software used in GitHub Actions and several related packages can be tricked into executing malicious code. This could let an attacker take control of the affected system. Update to the latest ...

10.0

vm2 may run malicious code

GHSA-qcp4-v2jj-fjx8 CVE-2026-44006 ROOT-APP-NPM-CVE-2026-44006

The vm2 library used in several Node.js projects can be tricked into executing unwanted code, which could let an attacker take control of your system. Update all vm2 packages (including rootio/@rootio...

10.0

vm2 package may let attackers run code

ROOT-APP-NPM-CVE-2026-44005 GHSA-vwrp-x96c-mhwq CVE-2026-44005

The vm2 library used in several projects can be tricked into executing harmful code. This creates a risk that an attacker could take control of your system or data. Update vm2 to the latest released v...

10.0

Apache Hive may allow data tampering through Jackson library

CLEANSTART-2026-WO77133

The Apache Hive software includes a version of the FasterXML Jackson data‑binding library that can be tricked into processing crafted data in an unsafe way. This could let an attacker alter or corrupt...

10.0

Apache Hive permits SQL injection through pgjdbc driver

CLEANSTART-2026-DW89349

The PostgreSQL JDBC driver used by Apache Hive can let an attacker add their own SQL commands if the driver is set to PreferQueryMode=SIMPLE. This could let a malicious user read, change, or delete da...

10.0

external-dns, temporal-server-fips, vault could skip source address validation

CLEANSTART-2026-AM91695

The external-dns, temporal-server-fips, and vault packages can fail to verify the source IP address when a callback other than a public key is used, potentially allowing unauthorized connections. This...

10.0

Microsoft Bookings lets attackers gain higher access

CVE-2026-94510

Microsoft Bookings contains a flaw that lets a user who should not have permission trick the system into thinking they are authorized. This can allow an attacker on the network to gain the same rights...

9.9

Tenable Identity Exposure SaaS lets low‑privileged user run commands

CVE-2026-106126

In Tenable Identity Exposure's cloud service, a user with only basic rights can trick the system into running any command with full system authority on the primary domain controller. This could let an...

9.4

vm2 packages could let attackers run code

GHSA-947f-4v7f-x2v8 CVE-2026-43999 ROOT-APP-NPM-CVE-2026-43999

The vm2 library used in several GitHub and npm projects can be tricked into executing unwanted code. This could let a malicious user take control of your system or data. Update to the latest patched v...

9.9

langfuse could let attackers access or modify data

CLEANSTART-2026-CM96340

The langfuse package version 3.225.9-r4 has a security weakness that could allow unauthorized people to view or change information. This risk is fixed in newer releases of langfuse. Update to the late...

9.9

langfuse-worker may allow unauthorized actions until updated

CLEANSTART-2026-PO83122

The langfuse-worker component from cleanstart can be exploited in its current version, potentially letting attackers affect your system. The problem is fixed in newer releases, so upgrade to the lates...

9.9

Go standard library can create files outside intended folder

CVE-2026-56857 GO-2026-6604 UBUNTU-CVE-2026-56857 BELL-CVE-2026-56857

When Go programs use the file‑creation functions that handle directories and a folder shortcut (junction) points to an empty location, the code may create a new folder at the shortcut’s target, even i...

9.8

IBM Guardium Data Protection lets remote attacker run commands

CVE-2026-84249

Versions 12.2 and 12.2.2 of IBM Guardium Data Protection do not properly check who is sending a request for an important management function. This weakness could let someone on the network perform act...

9.8

IBM Guardium Data Protection Sniffer can run attacker code

CVE-2026-84246

The Sniffer part of IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 may let a remote attacker cause the software to run malicious code. This happens because the program can overflow a memory...

9.8

IBM Guardium Data Protection lets remote attacker run SQL

CVE-2026-84209

The Guardium Data Protection product can be tricked into running unwanted database commands from outside the network. This could let an attacker read, change, or delete protected data. Apply the lates...

9.8

IBM Guardium Data Protection Sniffer can be remotely hijacked

CVE-2026-84198

The Sniffer component in IBM Guardium Data Protection versions 12.0 through 12.2 may let a remote attacker run their own code on the server because of a memory handling mistake. This could let the att...

9.8

IBM Guardium Data Protection may crash or be hijacked

CVE-2026-84058

The Guardium Data Protection system that monitors database traffic can be fooled by a specially crafted Microsoft SQL Server connection request. If an attacker sends this malformed request to a Guardi...

9.8

IBM Guardium Data Protection may let attackers run commands

CVE-2026-84057

Versions 12.2.2 and 12.1 of IBM Guardium Data Protection can be tricked into executing arbitrary operating‑system commands sent over the network. An attacker who succeeds could take control of the ser...

9.8

IBM Guardium Data Protection Sniffer allows remote code execution

CVE-2026-84035

The Sniffer part of IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 can be tricked into running malicious code from a distance. This could let an attacker take control of the system or acces...

9.8

IBM Guardium Data Protection Sniffer can run attacker code

CVE-2026-82895

The Sniffer component in IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 may let a remote user cause the software to run their own code. This could let an attacker take control of the system...

9.8

IBM Guardium Data Protection lets remote attacker alter database

CVE-2026-81932

The Sniffer component in IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 can be tricked into running malicious database commands. This could let an outsider view, add, change, or delete data...

9.8

IBM Guardium Data Protection allows remote SQL injection

CVE-2026-80381

The Sniffer component in IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 can be tricked into running malicious database commands sent over the network. This could let an attacker read, chan...

9.8

IBM Guardium Data Protection Sniffer can run attacker code

CVE-2026-75875

The Sniffer component in IBM Guardium Data Protection versions 12.0 through 12.2 can be fooled into accessing files it shouldn't, allowing a remote attacker to run their own code on the server. This c...

9.8