Published threat advisories for September 22, 2026

IBM Financial Transaction Manager for Red Hat OpenShift has a critical vulnerability allowing remote code execution due to improper deserialization of untrusted data. This means an attacker could potentially run their own code on the system if the vulnerability is reachable. Understanding if your deployment is affected

NVD modified: NVD date unavailable

A critical vulnerability in IBM Financial Transaction Manager for Red Hat OpenShift allows remote attackers to execute arbitrary code by improperly handling user input. This could impact the integrity and availability of financial transaction processing systems. Readers should care because it affects critical financial

NVD modified: NVD date unavailable

The Apache HTTP Server on Windows has an insecure installation directory vulnerability, allowing authenticated users to write to the default installation path. This could enable the modification of server files, potentially leading to further system compromise. The risk hinges on whether this specific configuration is

NVD modified: NVD date unavailable

Adobe Experience Manager Forms JEE has an authorization vulnerability enabling unauthenticated attackers to execute arbitrary code remotely. This flaw could compromise system integrity and availability if network services are accessible.

NVD modified: NVD date unavailable

Adobe Connect has a stored cross-site scripting vulnerability allowing attackers to inject malicious scripts into form fields. If reachable, these scripts could execute in a user's browser, potentially leading to unauthorized access or control of their account or session. Confirming your environment's exposure is key t

NVD modified: NVD date unavailable

Adobe Connect has a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into form fields. If exploited, these scripts can execute in a user's browser, potentially leading to unauthorized access or control of their account or session. Confirm if Adobe Connect is in use to assess p

NVD modified: NVD date unavailable

Adobe Connect has a stored Cross-Site Scripting vulnerability that allows attackers to inject malicious scripts into form fields. When a user accesses a page with a vulnerable field, these scripts can execute in their browser, potentially leading to elevated access or control over their account or session.

NVD modified: NVD date unavailable

Adobe Campaign Classic is affected by an incorrect authorization vulnerability that could allow an unauthenticated attacker to execute arbitrary code remotely without user interaction. This critical flaw could impact system data and service behavior.

NVD modified: NVD date unavailable

Adobe Campaign Classic is susceptible to code injection, potentially allowing an attacker to execute arbitrary code without user interaction. This vulnerability impacts a core marketing automation platform, raising concerns about system integrity and confidentiality if network-accessible instances are reachable.

NVD modified: NVD date unavailable

A path traversal vulnerability in Lantronix web management portals allows authenticated attackers to write arbitrary files to any filesystem location, leading to remote code execution. This could result in a complete loss of device confidentiality, integrity, and availability, potentially affecting downstream connected

NVD modified: NVD date unavailable

A critical vulnerability exists in Lantronix web management portals, allowing unauthenticated attackers to bypass security and execute remote code. This could lead to a complete loss of confidentiality, integrity, and availability for affected devices and potentially impact downstream systems.

NVD modified: NVD date unavailable

A stack-based buffer overflow vulnerability exists in Lantronix management devices, allowing authenticated attackers to execute arbitrary code. This could lead to a complete loss of confidentiality, integrity, and availability for the affected device and any downstream serial-attached equipment.

NVD modified: NVD date unavailable

NVIDIA Infrastructure Controller for Linux contains an OS command injection vulnerability that could allow an unauthenticated network attacker to execute code, tamper with data, disrupt services, or disclose information.

NVD modified: NVD date unavailable

An improper certificate validation vulnerability exists in NVIDIA Infrastructure Controller for Linux. This could allow an attacker to disclose sensitive information, tamper with data, or disrupt service if the controller is reachable.

NVD modified: NVD date unavailable

A vulnerability exists in NVIDIA's Infrastructure Controller for Linux concerning hard-coded credentials. If reachable, an attacker could exploit this to escalate privileges, tamper with data, cause denial of service, or disclose information. This could impact the integrity and availability of systems managed by the co

NVD modified: NVD date unavailable

An unauthenticated remote code execution vulnerability exists in the web management interface of certain D-Link devices. This flaw allows attackers to execute commands with the highest privileges, potentially leading to full device compromise and use as a pivot point into the local network. The main concern at this tim

NVD modified: NVD date unavailable

A vulnerability in a password recovery endpoint allows unauthenticated attackers to reset any user's password, including administrative accounts, by manipulating a user identifier. This could lead to unauthorized account control. The affected technology is a password recovery function, and the issue stems from a JWT to

NVD modified: NVD date unavailable

A vulnerability exists in a Perl library for internationalized domain names that may cause it to misinterpret encoded labels, potentially leading to divergent name resolution. This could allow a sender to craft a label that one system resolves and another rejects, impacting name resolution or service behavior. Assess t

NVD modified: NVD date unavailable

A critical vulnerability exists in Gigatech PDV5701 devices, allowing remote attackers to bypass authentication via manipulation of the WebSocket Service's `/index.html` file. The exploit is publicly available, and the vendor has not responded to disclosures. This could lead to unauthorized access or control of affecte

NVD modified: NVD date unavailable