NVD published two more high-severity CVE records for IBM Guardium Data Protection 12.2 on September 25: CVE-2026-85542 (CVSS 8.8), a command injection bug, and CVE-2026-85029 (CVSS 7.5), a path traversal flaw. IBM lists fix pack SqlGuard_12.0p233.
A credentialed adversary may submit a specially prepared GIM bundle, letting attacker-selected parameters reach the tar command.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
IBM disclosed CVE-2026-16841, a high-severity stack buffer overflow in AIX 7.2, 7.3 and PowerVM VIOS 4.1 that could allow remote arbitrary code execution with a CVSS score of 8.8. The flaw, published August 19 2026, requires prompt patching on affected enterprise Unix and virtualization platforms. Direct NVD page not yet surfaced in searches; support page referenced in related IBM AIX CVE reports.
IBM disclosed CVE-2026-10842, a high-severity vulnerability with CVSS 7.5 that could let remote attackers bypass security constraints in WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7. The flaw, classified as Authentication Bypass by Alternate Name, was published to the NVD on July 30, 2026.
Microsoft Office Outlook has an integer overflow flaw, CVE-2026-100208, that could let an unauthorized attacker run code over a network. Microsoft scores it 7.5 (High), and an attack needs user interaction.
IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.5 allow privilege escalation through a specially crafted query. CVE-2026-10543 carries a CVSS 3.1 score of 8.2 high, stems from improper authorization (CWE-285), and was published August 12, 2026. An IBM advisory is available.
Zyxel disclosed CVE-2026-6837, a command injection vulnerability in the export-cgi program of WAX650S firmware through version 7.10(ABRM.4)C0 that lets authenticated administrators execute OS commands. The flaw scores 7.2 on CVSS v3.1 and was published August 3, 2026.
