NCSC-2026-0321

Vulnerability from csaf_ncscnl - Published: 2026-08-21 08:13 - Updated: 2026-08-21 08:13
Summary
Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOS
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: IBM heeft kwetsbaarheden verholpen in AIX en PowerVM VIOS. Ook heeft IBM eerdere kwetsbaarheden in, onder andere, DB2, WebSphere, Oracle producten als Java en GraalVM, PostgreSQL, OpenSSH en Perl verholpen voor de producten geproduceerd voor AIX.
Interpretaties: Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service - Omzeilen van een beveiligingsmaatregel - Uitvoer van willekeurige code (root/admin-rechten) - Uitvoer van willekeurige code (gebruikersrechten) - Toegang tot gevoelige gegevens - Manipulatie van gegevens - Verhogen van privileges
Oplossingen: De leveranciers hebben updates uitgebracht voor PostgreSQL, IBM AIX, IBM PowerVM VIOS, Perl modules, OpenSSH, Oracle Java SE, Oracle GraalVM, OpenJDK, IBM Db2 Client en Server, en Oracle Communications Cloud Native Core Certificate Management om de beschreven kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23: Relative Path Traversal
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-61: UNIX Symbolic Link (Symlink) Following
CWE-73: External Control of File Name or Path
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-121: Stack-based Buffer Overflow
CWE-122: Heap-based Buffer Overflow
CWE-124: Buffer Underwrite ('Buffer Underflow')
CWE-125: Out-of-bounds Read
CWE-128: Wrap-around Error
CWE-129: Improper Validation of Array Index
CWE-134: Use of Externally-Controlled Format String
CWE-190: Integer Overflow or Wraparound
CWE-191: Integer Underflow (Wrap or Wraparound)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-242: Use of Inherently Dangerous Function
CWE-248: Uncaught Exception
CWE-269: Improper Privilege Management
CWE-284: Improper Access Control
CWE-285: Improper Authorization
CWE-287: Improper Authentication
CWE-295: Improper Certificate Validation
CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-312: Cleartext Storage of Sensitive Information
CWE-319: Cleartext Transmission of Sensitive Information
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-347: Improper Verification of Cryptographic Signature
CWE-348: Use of Less Trusted Source
CWE-358: Improperly Implemented Security Check for Standard
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-369: Divide By Zero
CWE-385: Covert Timing Channel
CWE-400: Uncontrolled Resource Consumption
CWE-404: Improper Resource Shutdown or Release
CWE-407: Inefficient Algorithmic Complexity
CWE-416: Use After Free
CWE-426: Untrusted Search Path
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-476: NULL Pointer Dereference
CWE-502: Deserialization of Untrusted Data
CWE-522: Insufficiently Protected Credentials
CWE-611: Improper Restriction of XML External Entity Reference
CWE-674: Uncontrolled Recursion
CWE-693: Protection Mechanism Failure
CWE-696: Incorrect Behavior Order
CWE-707: Improper Neutralization
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-787: Out-of-bounds Write
CWE-805: Buffer Access with Incorrect Length Value
CWE-822: Untrusted Pointer Dereference
CWE-825: Expired Pointer Dereference
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-862: Missing Authorization
CWE-908: Use of Uninitialized Resource
CWE-1284: Improper Validation of Specified Quantity in Input
CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
CWE-1287: Improper Validation of Specified Type of Input
CWE-1333: Inefficient Regular Expression Complexity

PostgreSQL versions prior to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 have a vulnerability in the CREATE STATISTICS command due to missing schema CREATE privilege checks, enabling denial of service and potential information disclosure.

CWE-862 - Missing Authorization
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

PostgreSQL libpq client library versions prior to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 contain integer wraparound and privilege check vulnerabilities (CVE-2025-12817, CVE-2025-12818) causing memory corruption and denial of service.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple security issues in Perl's IO::Uncompress::Unzip before version 2.215 include uncaught exceptions from malformed DOS date fields, heap buffer overflow in regex compilation on 32-bit builds, memory copying flaws in Socket's pack_ip_mreq_source(), integer overflow in pack/unpack, and regex trie branch-count overflow causing incorrect pattern matching.

CWE-248 - Uncaught Exception
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.17, and 14.22 contain security vulnerabilities including improper 'oidvector' type validation, intarray input flaws, pgcrypto buffer overruns, and multibyte character length validation errors.

CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.17, and 14.22 contain critical security vulnerabilities including arbitrary code execution via intarray and pgcrypto extensions, memory disclosure, and multibyte character validation flaws.

CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple heap buffer overflow and memory handling vulnerabilities in PostgreSQL's pgcrypto, intarray, and related components across versions prior to 14.21, 15.16, 16.12, 17.8, and 18.2 allow arbitrary code execution, memory disclosure, and data corruption.

CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple PostgreSQL versions prior to 14.21, 15.16, 16.12, 17.8, and 18.2 contain vulnerabilities including missing multibyte character length validation, memory disclosure, and arbitrary code execution in intarray and pgcrypto modules.

CWE-129 - Improper Validation of Array Index
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple security vulnerabilities in PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 include missing authorization checks in CREATE TYPE for multirange types, SQL injection, denial of service, buffer overflows, and information leaks.

CWE-862 - Missing Authorization
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 contain integer overflow vulnerabilities and other security flaws that allow unprivileged users to cause memory corruption, privilege bypass, SQL injection, and other critical issues.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple PostgreSQL versions prior to 14.23, 15.18, 16.14, 17.10, and 18.4 contain critical vulnerabilities including a format string flaw in the timeofday() function that leaks server memory, along with privilege bypass, SQL injection, and denial of service issues.

CWE-134 - Use of Externally-Controlled Format String
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 contain critical vulnerabilities including symlink following in pg_basebackup and pg_rewind allowing origin superusers to overwrite local files, along with privilege bypass, SQL injection, timing attacks, and buffer overflows.

CWE-61 - UNIX Symbolic Link (Symlink) Following
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 contain critical vulnerabilities including buffer overflows in libpq lo_* and PQfn functions, privilege enforcement flaws, SQL injection, and timing attacks.

CWE-242 - Use of Inherently Dangerous Function
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple security vulnerabilities in PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 include a covert timing channel in MD5 password comparison, privilege bypass, SQL injection, integer overflows, and denial of service.

CWE-385 - Covert Timing Channel
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 contain critical vulnerabilities including a stack buffer overflow and SQL injection in the 'refint' module, along with various privilege, overflow, path traversal, and timing attack issues.

CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

LWP::UserAgent versions prior to 6.83 for Perl leak Authorization and Proxy-Authorization headers during cross-origin redirects, exposing sensitive credentials to attacker-controlled hosts, addressed by CVE-2026-8368.

CWE-522 - Insufficiently Protected Credentials
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM WebSphere Application Server versions 8.5, 9.0, and Liberty Continuous Delivery contain a vulnerability in the ORB component of IBM SDK, Java Technology Edition, allowing a malicious IIOP server to load and instantiate arbitrary classes, potentially enabling unauthorized code execution.

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

HTML::Entities versions before 3.84 for Perl contain a use-after-free vulnerability in the _decode_entities function that can lead to reading freed heap memory and potential disclosure of adjacent heap contents.

CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Socket versions prior to 2.041 for Perl contain an out-of-bounds heap read vulnerability in the pack_ip_mreq_source() function, allowing potential exposure of adjacent heap memory and information disclosure.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, suffer from NIM server process crashes during client registration due to a buffer overflow vulnerability.

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability in the nimesis registration service that permits remote attackers to overwrite files via path traversal.

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM contain a security vulnerability that exposes intermediate certificate authority private keys in a public update file, enabling remote attackers to bypass security restrictions.

CWE-312 - Cleartext Storage of Sensitive Information
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM contain a vulnerability that permits remote authenticated attackers to execute arbitrary commands via improper handling of special elements in OS commands.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM contain a vulnerability in TLS certificate validation that may allow remote attackers unauthorized access to AIX systems.

CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Eclipse OMR versions up to 0.11 contain a flaw in the arraycmp SIMD implementation for Z and P architectures that fails to validate zero-length byte comparisons, enabling a low-privilege remote attacker to cause denial of service.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Eclipse OpenJ9 versions up to 0.60 contain a vulnerability in the -Xtrace option that can cause a buffer underflow when tracing method arguments, potentially leading to memory corruption.

CWE-124 - Buffer Underwrite ('Buffer Underflow')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Eclipse OpenJ9 versions up to 0.60 contain a flaw where the JVM incorrectly delegates calls from a recompiled abstract superclass method to an interface default method, causing potential unexpected behavior and data integrity issues.

CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to gain root privileges due to improper authentication mechanisms.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to access NFS-exported filesystems due to improper authentication mechanisms.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to cause denial of service via uncontrolled resource consumption.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to escalate privileges due to improper privilege management.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits remote attackers to cause a denial of service via an out-of-bounds write.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote authenticated attackers to execute arbitrary commands via improper neutralization of special elements in OS commands.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that allows remote attackers to cause a denial of service via a NULL pointer dereference.

CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to cause denial of service via uncontrolled resource consumption.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a time-of-check time-of-use race condition vulnerability that enables local attackers to cause denial of service and compromise data integrity.

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper certificate validation that enables remote attackers to impersonate the TNC policy server and alter network traffic.

CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that enables remote attackers to trigger a denial of service via unbounded recursion.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling remote authenticated attackers to cause denial of service and access sensitive data via an out-of-bounds write.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability involving an uninitialized stack pointer that can be exploited remotely to cause a denial of service.

CWE-908 - Use of Uninitialized Resource
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that allows remote attackers to cause a denial of service via a NULL pointer dereference.

CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to cause denial of service via uncontrolled resource consumption.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to perform out-of-bounds reads, potentially disclosing kernel memory.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability involving an integer underflow that can be exploited remotely to cause a denial of service condition.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to cause denial of service via uncontrolled resource consumption.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper handling of missing SSL client certificates, enabling remote attackers to cause denial of service conditions.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a TOCTOU race condition vulnerability enabling local attackers to overwrite critical files and access sensitive data.

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to an integer underflow in the IPv4 IP-options parser that allows remote attackers to access sensitive information.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling remote attackers to execute arbitrary code via an out-of-bounds write.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing remote attackers to execute arbitrary commands due to improper neutralization of special elements in OS commands.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing remote attackers to execute arbitrary commands due to improper neutralization of special elements in OS commands.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that allows remote attackers to cause a denial of service via a NULL pointer dereference.

CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to execute arbitrary commands via improper neutralization of shell metacharacters in DHCP options.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper array index boundary checking that allows a remote attacker to cause a denial of service.

CWE-129 - Improper Validation of Array Index
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 are susceptible to remote code execution via command injection triggered by specially crafted Router Advertisements.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a use-after-free vulnerability that can be exploited remotely to cause a denial of service condition.

CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that enables remote attackers to trigger a denial of service via an integer overflow.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to trigger a denial of service via a heap buffer overflow.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing remote attackers to manipulate network traffic and DNS settings due to improper authentication.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a command injection vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits remote attackers to trigger a denial of service via an out-of-bounds read.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to execute arbitrary code by exploiting improperly sanitized environment variables.

CWE-426 - Untrusted Search Path
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a stack-based buffer overflow vulnerability enabling remote attackers to execute arbitrary code.

CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a local privilege escalation vulnerability due to an out-of-bounds write condition exploitable by an attacker.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing local attackers to escalate privileges to root by exploiting improper enforcement of RBAC authentication roles.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability enabling local attackers to execute arbitrary commands via shell metacharacter injection.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack-based buffer overflow vulnerability enabling remote authenticated attackers to execute arbitrary code.

CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing remote attackers to execute arbitrary commands due to improper neutralization of special elements in OS commands.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to perform an out-of-bounds read, potentially exposing sensitive information.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits remote attackers to cause a denial of service via an out-of-bounds write.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a path traversal vulnerability that enables remote attackers to access sensitive information.

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer overflow vulnerability that may enable local attackers to access sensitive data or trigger denial of service conditions.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to perform an out-of-bounds read, potentially exposing sensitive information.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to trigger a denial of service via an out-of-bounds write.

CWE-369 - Divide By Zero
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling remote attackers to execute arbitrary code via an out-of-bounds write.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a vulnerability involving an out-of-bounds write that could enable remote code execution or denial of service.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an off-by-one bounds checking error that enables remote attackers to execute arbitrary code.

CWE-128 - Wrap-around Error
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack buffer overflow vulnerability that enables remote authenticated attackers to execute arbitrary code.

CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling local attackers to execute arbitrary code via an out-of-bounds write.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper validation of network-supplied pointers, enabling remote attackers to execute arbitrary code.

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a TOCTOU race condition vulnerability that enables local attackers to execute arbitrary code.

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to escalate privileges due to improper privilege management.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability where improper memory offset calculation during IPsec decapsulation allows a remote attacker to cause a denial of service.

CWE-191 - Integer Underflow (Wrap or Wraparound)
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a local privilege escalation vulnerability caused by improper authorization controls.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to overwrite arbitrary files by exploiting improper neutralization of special elements in input.

CWE-73 - External Control of File Name or Path
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a TOCTOU race condition vulnerability that allows local attackers to escalate privileges to root.

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a heap-based buffer overflow vulnerability that can be exploited remotely to cause a denial of service condition.

CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to execute arbitrary commands by exploiting improper validation of the ODMDIR environment variable.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a heap-based buffer overflow vulnerability that enables local attackers to escalate privileges.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a TOCTOU race condition vulnerability that enables local attackers to escalate privileges.

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that permits local attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to escalate privileges due to improper privilege management.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a heap-based buffer overflow vulnerability that enables local attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack-based buffer overflow vulnerability that enables local attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack-based buffer overflow vulnerability that enables local attackers to execute arbitrary code.

CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables local attackers to escalate privileges.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap-based buffer overflow vulnerability that enables local authenticated attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits a local attacker to cause denial of service by exhausting system resources.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits remote attackers to cause a denial of service via an out-of-bounds write.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to intercept messages and forge replies by exposing sensitive information.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper authentication that could allow remote attackers to access sensitive information.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits a local attacker to perform an out-of-bounds read, potentially disclosing sensitive kernel memory.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper symbolic link validation that allows a local attacker to cause a denial of service condition.

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability involving improper symbolic link resolution that permits local attackers to escalate privileges.

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability involving improper symbolic link handling that may allow local attackers to escalate privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer underflow vulnerability that enables local attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper privilege management that allows local attackers to execute arbitrary commands.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to execute arbitrary code due to improper authentication mechanisms.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an out-of-bounds write vulnerability that could enable remote attackers to compromise system confidentiality and integrity.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling local attackers to perform out-of-bounds reads, potentially exposing sensitive information or causing denial of service.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing local attackers to cause denial of service via NULL pointer dereference.

CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper certificate validation that enables remote attackers to execute arbitrary code.

CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a kernel heap over-read vulnerability that enables remote attackers to access sensitive data and cause denial of service conditions.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a use-after-free vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a buffer overflow vulnerability that may enable remote attackers to cause denial of service conditions.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that enables remote attackers to cause a denial of service via uncontrolled recursion.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a stack-based buffer overflow vulnerability enabling remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to an out-of-bounds read that allows local attackers to execute arbitrary code.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a format string vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-134 - Use of Externally-Controlled Format String
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a stack-based buffer overflow vulnerability enabling remote attackers to execute arbitrary code.

CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to execute arbitrary commands due to improper authentication mechanisms.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper privilege management that allows remote attackers to execute arbitrary code.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that enables remote attackers to trigger a denial of service via an integer overflow.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer overflow vulnerability during size computation that could enable remote attackers to execute arbitrary code.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper validation of an array size field, enabling remote attackers to cause a denial of service condition.

CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that allows remote attackers to cause a denial of service via a NULL pointer dereference.

CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack-based buffer overflow vulnerability enabling remote authenticated attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper allocation size validation that could enable a remote attacker to cause a denial of service.

CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to overwrite arbitrary files by exploiting improper symbolic link handling.

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to trigger a denial of service via an out-of-bounds write.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that permits local attackers to execute arbitrary code on affected systems.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability involving an out-of-bounds read that may enable remote attackers to access sensitive data and cause denial of service.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to bypass security restrictions by improperly limiting pathname access to restricted directories.

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that can be exploited remotely to cause a denial of service condition.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a heap-based buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer underflow vulnerability that may enable remote attackers to cause denial of service and potentially access sensitive information.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling remote authenticated attackers to perform out-of-bounds reads, potentially exposing sensitive information or causing denial of service.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables local attackers to cause denial of service by exhausting resources during directory record parsing.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote authenticated attackers to execute arbitrary commands via improper neutralization of special elements in OS commands.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack-based buffer overflow vulnerability that can be exploited remotely to cause a denial of service condition.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a heap-based buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote authenticated attackers to execute arbitrary commands via improper neutralization of special elements in OS commands.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to execute arbitrary code by exploiting improper validation of an attacker-controlled pointer.

CWE-822 - Untrusted Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an out-of-bounds write vulnerability that allows local attackers to escalate privileges.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that enables remote attackers to execute arbitrary code.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a pointer validation flaw in the AIX Virtual SCSI initiator driver that can lead to denial of service, privilege escalation, or full kernel compromise of the client LPAR.

CWE-822 - Untrusted Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 are susceptible to a remote unauthenticated denial-of-service attack via crafted UDP packets targeting an RPC service, resulting in complete system unavailability and necessitating an LPAR restart.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

A stack memory corruption vulnerability in the AIX IPsec ESP decapsulation handler affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, potentially causing kernel stack corruption, system crashes, and denial of service.

CWE-908 - Use of Uninitialized Resource
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a local privilege escalation vulnerability in cmdnim that allows unprivileged users to execute code with root privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that allows a local attacker to cause denial of service by improperly handling memory page table configurations.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability where a crafted filesystem image triggers kernel memory corruption via an out-of-bounds kernel-stack write, risking system crashes or privilege escalation.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple vulnerabilities affecting Oracle Java SE, Oracle GraalVM, OpenJDK versions 8, 11, 17, 21, 25, CRaC JDK variants, IBM Db2, and Oracle Communications Cloud Native Core Certificate Management allow unauthorized data access, denial of service, and data modification via various attack vectors.

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple vulnerabilities across Oracle Java SE, Oracle GraalVM, OpenJDK versions 8, 11, 17, 21, 25, CRaC JDK 17, 21, 25, IBM Java distributions, and Oracle Communications Cloud Native Core allow remote unauthenticated attackers to access sensitive data, cause denial of service, or modify data, with some requiring human interaction.

CWE-319 - Cleartext Transmission of Sensitive Information
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple critical vulnerabilities affect Oracle Java SE, Oracle GraalVM, OpenJDK (versions 8, 11, 17, 21, 25, 26), CRaC JDK (17, 21, 25), and Oracle Communications Cloud Native Core, enabling unauthorized data access, denial of service, and data modification with CVSS scores up to 7.5.

CWE-611 - Improper Restriction of XML External Entity Reference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple authentication, integer handling, and access control vulnerabilities in various OpenJDK, CRaC JDK, Oracle Java SE, Oracle GraalVM, and Oracle Communications products allow unauthenticated remote attackers to cause denial of service, unauthorized access, data modification, or data leakage.

CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple authentication, integer handling, and denial of service vulnerabilities affect various versions of Oracle Java SE, Oracle GraalVM, OpenJDK, CRaC JDK, IBM Java distributions, IBM Db2, and Oracle Communications Cloud Native Core Certificate Management, allowing unauthenticated attackers network access to cause partial denial of service, unauthorized data access, or data modification.

CWE-674 - Uncontrolled Recursion
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple authentication, integer handling, and access control vulnerabilities affect various Oracle Java SE, OpenJDK, CRaC JDK, and Oracle Communications products, enabling unauthenticated attackers to gain unauthorized data access, cause denial of service, or modify data.

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple vulnerabilities in Little CMS, including integer overflows in the CubeSize function, affect various versions of Little CMS and Oracle Java SE products, enabling denial of service, information disclosure, and potential code execution.

CWE-696 - Incorrect Behavior Order
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple vulnerabilities in Oracle Java SE and OpenJDK versions, including JSSE component flaws and client certificate verification issues, allow unauthenticated attackers network access via TLS to cause information disclosure, denial of service, and unauthorized data modification.

CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple security vulnerabilities affecting Oracle Java SE, Oracle GraalVM, and various OpenJDK versions allow unauthenticated network attackers to cause information disclosure, denial of service, and unauthorized data modification with CVSS scores around 3.7.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple security vulnerabilities affecting Oracle Java SE, Oracle GraalVM, and OpenJDK versions include denial of service, information disclosure, and unauthorized data access via various components and protocols.

CWE-1333 - Inefficient Regular Expression Complexity
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple vulnerabilities in Oracle Java SE and OpenJDK, including denial of service, information disclosure, and unauthorized data access, affect various versions and components such as SignatureFileVerifier and TLS protocols.

Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple vulnerabilities in Oracle Java SE versions 8u491, 8u491-perf, and 11.0.31, including an integer overflow in OpenJDK's TypedArray.prototype.set(), allow unauthenticated network attackers to cause denial of service and unauthorized data access.

CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple vulnerabilities in Oracle Java SE versions 8u491, 8u491-perf, and 11.0.31, as well as OpenJDK 11.0.32, allow unauthenticated network attackers to compromise data confidentiality, integrity, and cause out-of-bounds memory access with a CVSS score up to 7.4.

CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple security vulnerabilities in Oracle Java SE, Oracle GraalVM, and OpenJDK versions allow unauthenticated attackers to cause partial denial of service and unauthorized data access, primarily affecting sandboxed Java client deployments.

CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple critical vulnerabilities in Oracle Java SE, GraalVM, and OpenJDK versions allow unauthenticated network attackers to modify or delete data, cause denial of service, and exploit flaws in APIs and JAR file signing.

CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IO::Uncompress::Unzip versions prior to 2.220 for Perl contain a vulnerability in the fastForward() function that causes a per-byte read loop, leading to CPU exhaustion when processing malicious zip files.

CWE-407 - Inefficient Algorithmic Complexity
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

IO::Compress versions before 2.220 for Perl contain a critical vulnerability in File::GlobMapper that allows arbitrary code execution via a maliciously crafted output glob.

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

OpenSSH versions prior to 10.4 contain multiple vulnerabilities including improper file placement by sftp and scp clients, argument handling flaws, authentication bypasses, and a use-after-free bug, potentially leading to data disclosure, modification, or denial of service.

CWE-23 - Relative Path Traversal
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

OpenSSH versions prior to 10.4 contain multiple vulnerabilities including an scp flaw that places files in unintended parent directories during remote-to-remote copies, along with other issues affecting sftp, internal-sftp, GSSAPI options, forwarding, authentication, and client memory management.

CWE-23 - Relative Path Traversal
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

OpenSSH versions prior to 10.4 contain multiple vulnerabilities including internal-sftp's limitation to nine command-line arguments, improper file location constraints, undocumented GSSAPI behavior, and authentication bypasses, potentially leading to data disclosure, modification, or DoS.

CWE-1284 - Improper Validation of Specified Quantity in Input
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

OpenSSH versions prior to 10.4 contain multiple vulnerabilities including a failure of DisableForwarding=yes to override PermitTunnel=yes, leading to unauthorized network tunneling and other security issues such as improper file constraints, argument handling flaws, and client use-after-free bugs.

CWE-348 - Use of Less Trusted Source
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

OpenSSH versions prior to 10.4 contain multiple vulnerabilities including improper MaxAuthTries handling during GSSAPIAuthentication, argument and file location issues in sftp/scp, and a client use-after-free flaw, leading to denial of service, data modification, or information disclosure.

CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

OpenSSH versions prior to 10.4 contain multiple vulnerabilities including inconsistent enforcement of minimum authentication delay, improper file location constraints, argument handling flaws, and a use-after-free during host key re-exchange, enabling unauthorized access, brute-force attacks, and potential code execution.

CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

OpenSSH versions prior to 10.4 contain multiple vulnerabilities including a critical client-side use-after-free flaw during host key re-exchange, along with issues in sftp, scp, argument handling, configuration enforcement, and authentication bypasses.

CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*

Multiple vulnerabilities in Oracle Java SE, Oracle GraalVM, and OpenJDK affect various versions, allowing unauthenticated network attackers to gain unauthorized data access, cause denial of service, and exploit certificate validation flaws.

CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
vers:unknown/*
IBM / AIX
vers:unknown/*
vers:unknown/*
IBM / AIX, PowerVM VIOS
vers:unknown/*
References
URL Category
https://www.ibm.com/support/pages/node/7283858 external
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "IBM heeft kwetsbaarheden verholpen in AIX en PowerVM VIOS.\nOok heeft IBM eerdere kwetsbaarheden in, onder andere, DB2, WebSphere, Oracle producten als Java en GraalVM, PostgreSQL, OpenSSH en Perl verholpen voor de producten geproduceerd voor AIX.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service\n- Omzeilen van een beveiligingsmaatregel\n- Uitvoer van willekeurige code (root/admin-rechten)\n- Uitvoer van willekeurige code (gebruikersrechten)\n- Toegang tot gevoelige gegevens\n- Manipulatie van gegevens\n- Verhogen van privileges",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "De leveranciers hebben updates uitgebracht voor PostgreSQL, IBM AIX, IBM PowerVM VIOS, Perl modules, OpenSSH, Oracle Java SE, Oracle GraalVM, OpenJDK, IBM Db2 Client en Server, en Oracle Communications Cloud Native Core Certificate Management om de beschreven kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
        "title": "CWE-22"
      },
      {
        "category": "general",
        "text": "Relative Path Traversal",
        "title": "CWE-23"
      },
      {
        "category": "general",
        "text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
        "title": "CWE-59"
      },
      {
        "category": "general",
        "text": "UNIX Symbolic Link (Symlink) Following",
        "title": "CWE-61"
      },
      {
        "category": "general",
        "text": "External Control of File Name or Path",
        "title": "CWE-73"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
        "title": "CWE-78"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
        "title": "CWE-88"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
        "title": "CWE-89"
      },
      {
        "category": "general",
        "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
        "title": "CWE-94"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
        "title": "CWE-95"
      },
      {
        "category": "general",
        "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
        "title": "CWE-120"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
        "title": "CWE-124"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Wrap-around Error",
        "title": "CWE-128"
      },
      {
        "category": "general",
        "text": "Improper Validation of Array Index",
        "title": "CWE-129"
      },
      {
        "category": "general",
        "text": "Use of Externally-Controlled Format String",
        "title": "CWE-134"
      },
      {
        "category": "general",
        "text": "Integer Overflow or Wraparound",
        "title": "CWE-190"
      },
      {
        "category": "general",
        "text": "Integer Underflow (Wrap or Wraparound)",
        "title": "CWE-191"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Use of Inherently Dangerous Function",
        "title": "CWE-242"
      },
      {
        "category": "general",
        "text": "Uncaught Exception",
        "title": "CWE-248"
      },
      {
        "category": "general",
        "text": "Improper Privilege Management",
        "title": "CWE-269"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improper Authorization",
        "title": "CWE-285"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Improper Certificate Validation",
        "title": "CWE-295"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Excessive Authentication Attempts",
        "title": "CWE-307"
      },
      {
        "category": "general",
        "text": "Cleartext Storage of Sensitive Information",
        "title": "CWE-312"
      },
      {
        "category": "general",
        "text": "Cleartext Transmission of Sensitive Information",
        "title": "CWE-319"
      },
      {
        "category": "general",
        "text": "Use of a Broken or Risky Cryptographic Algorithm",
        "title": "CWE-327"
      },
      {
        "category": "general",
        "text": "Improper Verification of Cryptographic Signature",
        "title": "CWE-347"
      },
      {
        "category": "general",
        "text": "Use of Less Trusted Source",
        "title": "CWE-348"
      },
      {
        "category": "general",
        "text": "Improperly Implemented Security Check for Standard",
        "title": "CWE-358"
      },
      {
        "category": "general",
        "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
        "title": "CWE-362"
      },
      {
        "category": "general",
        "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
        "title": "CWE-367"
      },
      {
        "category": "general",
        "text": "Divide By Zero",
        "title": "CWE-369"
      },
      {
        "category": "general",
        "text": "Covert Timing Channel",
        "title": "CWE-385"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Inefficient Algorithmic Complexity",
        "title": "CWE-407"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "Untrusted Search Path",
        "title": "CWE-426"
      },
      {
        "category": "general",
        "text": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
        "title": "CWE-470"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Insufficiently Protected Credentials",
        "title": "CWE-522"
      },
      {
        "category": "general",
        "text": "Improper Restriction of XML External Entity Reference",
        "title": "CWE-611"
      },
      {
        "category": "general",
        "text": "Uncontrolled Recursion",
        "title": "CWE-674"
      },
      {
        "category": "general",
        "text": "Protection Mechanism Failure",
        "title": "CWE-693"
      },
      {
        "category": "general",
        "text": "Incorrect Behavior Order",
        "title": "CWE-696"
      },
      {
        "category": "general",
        "text": "Improper Neutralization",
        "title": "CWE-707"
      },
      {
        "category": "general",
        "text": "Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
        "title": "CWE-758"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Buffer Access with Incorrect Length Value",
        "title": "CWE-805"
      },
      {
        "category": "general",
        "text": "Untrusted Pointer Dereference",
        "title": "CWE-822"
      },
      {
        "category": "general",
        "text": "Expired Pointer Dereference",
        "title": "CWE-825"
      },
      {
        "category": "general",
        "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
        "title": "CWE-843"
      },
      {
        "category": "general",
        "text": "Missing Authorization",
        "title": "CWE-862"
      },
      {
        "category": "general",
        "text": "Use of Uninitialized Resource",
        "title": "CWE-908"
      },
      {
        "category": "general",
        "text": "Improper Validation of Specified Quantity in Input",
        "title": "CWE-1284"
      },
      {
        "category": "general",
        "text": "Improper Validation of Specified Index, Position, or Offset in Input",
        "title": "CWE-1285"
      },
      {
        "category": "general",
        "text": "Improper Validation of Specified Type of Input",
        "title": "CWE-1287"
      },
      {
        "category": "general",
        "text": "Inefficient Regular Expression Complexity",
        "title": "CWE-1333"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.ibm.com/support/pages/node/7283858"
      }
    ],
    "title": "Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOS",
    "tracking": {
      "current_release_date": "2026-08-21T08:13:11.874384Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0321",
      "initial_release_date": "2026-08-21T08:13:11.874384Z",
      "revision_history": [
        {
          "date": "2026-08-21T08:13:11.874384Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "AIX"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "AIX, PowerVM VIOS"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-12817",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authorization",
          "title": "CWE-862"
        },
        {
          "category": "description",
          "text": "PostgreSQL versions prior to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 have a vulnerability in the CREATE STATISTICS command due to missing schema CREATE privilege checks, enabling denial of service and potential information disclosure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-12817 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-12817.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-12817"
    },
    {
      "cve": "CVE-2025-12818",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "PostgreSQL libpq client library versions prior to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 contain integer wraparound and privilege check vulnerabilities (CVE-2025-12817, CVE-2025-12818) causing memory corruption and denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-12818 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-12818.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-12818"
    },
    {
      "cve": "CVE-2025-15649",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncaught Exception",
          "title": "CWE-248"
        },
        {
          "category": "description",
          "text": "Multiple security issues in Perl\u0027s IO::Uncompress::Unzip before version 2.215 include uncaught exceptions from malformed DOS date fields, heap buffer overflow in regex compilation on 32-bit builds, memory copying flaws in Socket\u0027s pack_ip_mreq_source(), integer overflow in pack/unpack, and regex trie branch-count overflow causing incorrect pattern matching.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-15649 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-15649.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-15649"
    },
    {
      "cve": "CVE-2026-2003",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Specified Type of Input",
          "title": "CWE-1287"
        },
        {
          "category": "description",
          "text": "Multiple PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.17, and 14.22 contain security vulnerabilities including improper \u0027oidvector\u0027 type validation, intarray input flaws, pgcrypto buffer overruns, and multibyte character length validation errors.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-2003 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-2003.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-2003"
    },
    {
      "cve": "CVE-2026-2004",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Specified Type of Input",
          "title": "CWE-1287"
        },
        {
          "category": "description",
          "text": "Multiple PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.17, and 14.22 contain critical security vulnerabilities including arbitrary code execution via intarray and pgcrypto extensions, memory disclosure, and multibyte character validation flaws.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-2004 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-2004.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-2004"
    },
    {
      "cve": "CVE-2026-2005",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "Multiple heap buffer overflow and memory handling vulnerabilities in PostgreSQL\u0027s pgcrypto, intarray, and related components across versions prior to 14.21, 15.16, 16.12, 17.8, and 18.2 allow arbitrary code execution, memory disclosure, and data corruption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-2005 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-2005.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-2005"
    },
    {
      "cve": "CVE-2026-2006",
      "cwe": {
        "id": "CWE-129",
        "name": "Improper Validation of Array Index"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Array Index",
          "title": "CWE-129"
        },
        {
          "category": "other",
          "text": "Improper Validation of Specified Index, Position, or Offset in Input",
          "title": "CWE-1285"
        },
        {
          "category": "description",
          "text": "Multiple PostgreSQL versions prior to 14.21, 15.16, 16.12, 17.8, and 18.2 contain vulnerabilities including missing multibyte character length validation, memory disclosure, and arbitrary code execution in intarray and pgcrypto modules.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-2006 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-2006.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-2006"
    },
    {
      "cve": "CVE-2026-6472",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authorization",
          "title": "CWE-862"
        },
        {
          "category": "description",
          "text": "Multiple security vulnerabilities in PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 include missing authorization checks in CREATE TYPE for multirange types, SQL injection, denial of service, buffer overflows, and information leaks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-6472 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6472.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-6472"
    },
    {
      "cve": "CVE-2026-6473",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "Multiple PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 contain integer overflow vulnerabilities and other security flaws that allow unprivileged users to cause memory corruption, privilege bypass, SQL injection, and other critical issues.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-6473 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6473.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-6473"
    },
    {
      "cve": "CVE-2026-6474",
      "cwe": {
        "id": "CWE-134",
        "name": "Use of Externally-Controlled Format String"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Externally-Controlled Format String",
          "title": "CWE-134"
        },
        {
          "category": "description",
          "text": "Multiple PostgreSQL versions prior to 14.23, 15.18, 16.14, 17.10, and 18.4 contain critical vulnerabilities including a format string flaw in the timeofday() function that leaks server memory, along with privilege bypass, SQL injection, and denial of service issues.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-6474 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6474.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-6474"
    },
    {
      "cve": "CVE-2026-6475",
      "cwe": {
        "id": "CWE-61",
        "name": "UNIX Symbolic Link (Symlink) Following"
      },
      "notes": [
        {
          "category": "other",
          "text": "UNIX Symbolic Link (Symlink) Following",
          "title": "CWE-61"
        },
        {
          "category": "other",
          "text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
          "title": "CWE-59"
        },
        {
          "category": "description",
          "text": "Multiple PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 contain critical vulnerabilities including symlink following in pg_basebackup and pg_rewind allowing origin superusers to overwrite local files, along with privilege bypass, SQL injection, timing attacks, and buffer overflows.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-6475 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6475.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-6475"
    },
    {
      "cve": "CVE-2026-6477",
      "cwe": {
        "id": "CWE-242",
        "name": "Use of Inherently Dangerous Function"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Inherently Dangerous Function",
          "title": "CWE-242"
        },
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "Multiple PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 contain critical vulnerabilities including buffer overflows in libpq lo_* and PQfn functions, privilege enforcement flaws, SQL injection, and timing attacks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-6477 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6477.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-6477"
    },
    {
      "cve": "CVE-2026-6478",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "notes": [
        {
          "category": "other",
          "text": "Covert Timing Channel",
          "title": "CWE-385"
        },
        {
          "category": "description",
          "text": "Multiple security vulnerabilities in PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 include a covert timing channel in MD5 password comparison, privilege bypass, SQL injection, integer overflows, and denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-6478 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6478.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-6478"
    },
    {
      "cve": "CVE-2026-6637",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
          "title": "CWE-89"
        },
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "Multiple PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23 contain critical vulnerabilities including a stack buffer overflow and SQL injection in the \u0027refint\u0027 module, along with various privilege, overflow, path traversal, and timing attack issues.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-6637 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6637.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-6637"
    },
    {
      "cve": "CVE-2026-8368",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insufficiently Protected Credentials",
          "title": "CWE-522"
        },
        {
          "category": "description",
          "text": "LWP::UserAgent versions prior to 6.83 for Perl leak Authorization and Proxy-Authorization headers during cross-origin redirects, exposing sensitive credentials to attacker-controlled hosts, addressed by CVE-2026-8368.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-8368 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-8368.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-8368"
    },
    {
      "cve": "CVE-2026-8400",
      "cwe": {
        "id": "CWE-470",
        "name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
          "title": "CWE-470"
        },
        {
          "category": "description",
          "text": "IBM WebSphere Application Server versions 8.5, 9.0, and Liberty Continuous Delivery contain a vulnerability in the ORB component of IBM SDK, Java Technology Edition, allowing a malicious IIOP server to load and instantiate arbitrary classes, potentially enabling unauthorized code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-8400 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-8400.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-8400"
    },
    {
      "cve": "CVE-2026-8829",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "description",
          "text": "HTML::Entities versions before 3.84 for Perl contain a use-after-free vulnerability in the _decode_entities function that can lead to reading freed heap memory and potential disclosure of adjacent heap contents.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-8829 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-8829.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-8829"
    },
    {
      "cve": "CVE-2026-12087",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "other",
          "text": "Buffer Access with Incorrect Length Value",
          "title": "CWE-805"
        },
        {
          "category": "description",
          "text": "Socket versions prior to 2.041 for Perl contain an out-of-bounds heap read vulnerability in the pack_ip_mreq_source() function, allowing potential exposure of adjacent heap memory and information disclosure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-12087 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12087.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-12087"
    },
    {
      "cve": "CVE-2026-14970",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, suffer from NIM server process crashes during client registration due to a buffer overflow vulnerability.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-14970 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14970.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-14970"
    },
    {
      "cve": "CVE-2026-15061",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability in the nimesis registration service that permits remote attackers to overwrite files via path traversal.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15061 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15061.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-15061"
    },
    {
      "cve": "CVE-2026-15065",
      "cwe": {
        "id": "CWE-312",
        "name": "Cleartext Storage of Sensitive Information"
      },
      "notes": [
        {
          "category": "other",
          "text": "Cleartext Storage of Sensitive Information",
          "title": "CWE-312"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM contain a security vulnerability that exposes intermediate certificate authority private keys in a public update file, enabling remote attackers to bypass security restrictions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15065 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15065.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-15065"
    },
    {
      "cve": "CVE-2026-15068",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM contain a vulnerability that permits remote authenticated attackers to execute arbitrary commands via improper handling of special elements in OS commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15068 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15068.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-15068"
    },
    {
      "cve": "CVE-2026-15078",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM contain a vulnerability in TLS certificate validation that may allow remote attackers unauthorized access to AIX systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15078 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15078.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-15078"
    },
    {
      "cve": "CVE-2026-16243",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "other",
          "text": "Improper Validation of Specified Quantity in Input",
          "title": "CWE-1284"
        },
        {
          "category": "description",
          "text": "Eclipse OMR versions up to 0.11 contain a flaw in the arraycmp SIMD implementation for Z and P architectures that fails to validate zero-length byte comparisons, enabling a low-privilege remote attacker to cause denial of service.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16243 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16243.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16243"
    },
    {
      "cve": "CVE-2026-16439",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
          "title": "CWE-124"
        },
        {
          "category": "description",
          "text": "Eclipse OpenJ9 versions up to 0.60 contain a vulnerability in the -Xtrace option that can cause a buffer underflow when tracing method arguments, potentially leading to memory corruption.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16439 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16439.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16439"
    },
    {
      "cve": "CVE-2026-16441",
      "cwe": {
        "id": "CWE-758",
        "name": "Reliance on Undefined, Unspecified, or Implementation-Defined Behavior"
      },
      "notes": [
        {
          "category": "other",
          "text": "Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
          "title": "CWE-758"
        },
        {
          "category": "other",
          "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
          "title": "CWE-843"
        },
        {
          "category": "description",
          "text": "Eclipse OpenJ9 versions up to 0.60 contain a flaw where the JVM incorrectly delegates calls from a recompiled abstract superclass method to an interface default method, causing potential unexpected behavior and data integrity issues.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:L/SI:H/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16441 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16441.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16441"
    },
    {
      "cve": "CVE-2026-16656",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to gain root privileges due to improper authentication mechanisms.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16656 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16656.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16656"
    },
    {
      "cve": "CVE-2026-16686",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to access NFS-exported filesystems due to improper authentication mechanisms.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16686 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16686.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16686"
    },
    {
      "cve": "CVE-2026-16690",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to cause denial of service via uncontrolled resource consumption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16690 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16690.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16690"
    },
    {
      "cve": "CVE-2026-16703",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to escalate privileges due to improper privilege management.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16703 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16703.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16703"
    },
    {
      "cve": "CVE-2026-16706",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits remote attackers to cause a denial of service via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16706 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16706.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16706"
    },
    {
      "cve": "CVE-2026-16814",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16814 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16814.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16814"
    },
    {
      "cve": "CVE-2026-16816",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote authenticated attackers to execute arbitrary commands via improper neutralization of special elements in OS commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16816 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16816.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16816"
    },
    {
      "cve": "CVE-2026-16817",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that allows remote attackers to cause a denial of service via a NULL pointer dereference.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16817 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16817.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16817"
    },
    {
      "cve": "CVE-2026-16818",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to cause denial of service via uncontrolled resource consumption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16818 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16818.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16818"
    },
    {
      "cve": "CVE-2026-16819",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "other",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
          "title": "CWE-367"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a time-of-check time-of-use race condition vulnerability that enables local attackers to cause denial of service and compromise data integrity.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16819 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16819.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16819"
    },
    {
      "cve": "CVE-2026-16822",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper certificate validation that enables remote attackers to impersonate the TNC policy server and alter network traffic.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16822 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16822.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16822"
    },
    {
      "cve": "CVE-2026-16824",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that enables remote attackers to trigger a denial of service via unbounded recursion.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16824 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16824.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16824"
    },
    {
      "cve": "CVE-2026-16825",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling remote authenticated attackers to cause denial of service and access sensitive data via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16825 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16825.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16825"
    },
    {
      "cve": "CVE-2026-16827",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Uninitialized Resource",
          "title": "CWE-908"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability involving an uninitialized stack pointer that can be exploited remotely to cause a denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16827 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16827.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16827"
    },
    {
      "cve": "CVE-2026-16829",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that allows remote attackers to cause a denial of service via a NULL pointer dereference.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16829 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16829.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16829"
    },
    {
      "cve": "CVE-2026-16831",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to cause denial of service via uncontrolled resource consumption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16831 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16831.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16831"
    },
    {
      "cve": "CVE-2026-16833",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to perform out-of-bounds reads, potentially disclosing kernel memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16833 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16833.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16833"
    },
    {
      "cve": "CVE-2026-16834",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability involving an integer underflow that can be exploited remotely to cause a denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16834 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16834.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16834"
    },
    {
      "cve": "CVE-2026-16836",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to cause denial of service via uncontrolled resource consumption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16836 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16836.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16836"
    },
    {
      "cve": "CVE-2026-16837",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper handling of missing SSL client certificates, enabling remote attackers to cause denial of service conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16837 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16837.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16837"
    },
    {
      "cve": "CVE-2026-16838",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "other",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
          "title": "CWE-367"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a TOCTOU race condition vulnerability enabling local attackers to overwrite critical files and access sensitive data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16838 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16838.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16838"
    },
    {
      "cve": "CVE-2026-16839",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to an integer underflow in the IPv4 IP-options parser that allows remote attackers to access sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16839 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16839.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16839"
    },
    {
      "cve": "CVE-2026-16840",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling remote attackers to execute arbitrary code via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16840 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16840.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16840"
    },
    {
      "cve": "CVE-2026-16841",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16841 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16841.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16841"
    },
    {
      "cve": "CVE-2026-16842",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing remote attackers to execute arbitrary commands due to improper neutralization of special elements in OS commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16842 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16842.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16842"
    },
    {
      "cve": "CVE-2026-16844",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing remote attackers to execute arbitrary commands due to improper neutralization of special elements in OS commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16844 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16844.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16844"
    },
    {
      "cve": "CVE-2026-16845",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16845 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16845.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16845"
    },
    {
      "cve": "CVE-2026-16846",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that allows remote attackers to cause a denial of service via a NULL pointer dereference.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16846 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16846.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16846"
    },
    {
      "cve": "CVE-2026-16847",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16847 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16847.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16847"
    },
    {
      "cve": "CVE-2026-16848",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to execute arbitrary commands via improper neutralization of shell metacharacters in DHCP options.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16848 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16848.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16848"
    },
    {
      "cve": "CVE-2026-16849",
      "cwe": {
        "id": "CWE-129",
        "name": "Improper Validation of Array Index"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Array Index",
          "title": "CWE-129"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper array index boundary checking that allows a remote attacker to cause a denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16849 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16849.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16849"
    },
    {
      "cve": "CVE-2026-16850",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 are susceptible to remote code execution via command injection triggered by specially crafted Router Advertisements.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16850 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16850.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16850"
    },
    {
      "cve": "CVE-2026-16851",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a use-after-free vulnerability that can be exploited remotely to cause a denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16851 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16851.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16851"
    },
    {
      "cve": "CVE-2026-16852",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that enables remote attackers to trigger a denial of service via an integer overflow.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16852 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16852.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16852"
    },
    {
      "cve": "CVE-2026-16855",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to trigger a denial of service via a heap buffer overflow.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16855 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16855.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16855"
    },
    {
      "cve": "CVE-2026-16857",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing remote attackers to manipulate network traffic and DNS settings due to improper authentication.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16857 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16857.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16857"
    },
    {
      "cve": "CVE-2026-16862",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16862 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16862.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16862"
    },
    {
      "cve": "CVE-2026-16864",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16864 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16864.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16864"
    },
    {
      "cve": "CVE-2026-16865",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a command injection vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16865 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16865.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16865"
    },
    {
      "cve": "CVE-2026-16866",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits remote attackers to trigger a denial of service via an out-of-bounds read.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16866 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16866.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16866"
    },
    {
      "cve": "CVE-2026-16869",
      "cwe": {
        "id": "CWE-426",
        "name": "Untrusted Search Path"
      },
      "notes": [
        {
          "category": "other",
          "text": "Untrusted Search Path",
          "title": "CWE-426"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to execute arbitrary code by exploiting improperly sanitized environment variables.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16869 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16869.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16869"
    },
    {
      "cve": "CVE-2026-16872",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a stack-based buffer overflow vulnerability enabling remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16872 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16872.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16872"
    },
    {
      "cve": "CVE-2026-16873",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a local privilege escalation vulnerability due to an out-of-bounds write condition exploitable by an attacker.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16873 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16873.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16873"
    },
    {
      "cve": "CVE-2026-16874",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing local attackers to escalate privileges to root by exploiting improper enforcement of RBAC authentication roles.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16874 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16874.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16874"
    },
    {
      "cve": "CVE-2026-16875",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability enabling local attackers to execute arbitrary commands via shell metacharacter injection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16875 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16875.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16875"
    },
    {
      "cve": "CVE-2026-16877",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack-based buffer overflow vulnerability enabling remote authenticated attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16877 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16877.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16877"
    },
    {
      "cve": "CVE-2026-16882",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing remote attackers to execute arbitrary commands due to improper neutralization of special elements in OS commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16882 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16882.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16882"
    },
    {
      "cve": "CVE-2026-16883",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to perform an out-of-bounds read, potentially exposing sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16883 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16883.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16883"
    },
    {
      "cve": "CVE-2026-16885",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16885 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16885.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16885"
    },
    {
      "cve": "CVE-2026-16886",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits remote attackers to cause a denial of service via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16886 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16886.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16886"
    },
    {
      "cve": "CVE-2026-16888",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a path traversal vulnerability that enables remote attackers to access sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16888 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16888.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16888"
    },
    {
      "cve": "CVE-2026-16890",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer overflow vulnerability that may enable local attackers to access sensitive data or trigger denial of service conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16890 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16890.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16890"
    },
    {
      "cve": "CVE-2026-16891",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to perform an out-of-bounds read, potentially exposing sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16891 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16891.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16891"
    },
    {
      "cve": "CVE-2026-16894",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16894 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16894.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16894"
    },
    {
      "cve": "CVE-2026-16897",
      "cwe": {
        "id": "CWE-369",
        "name": "Divide By Zero"
      },
      "notes": [
        {
          "category": "other",
          "text": "Divide By Zero",
          "title": "CWE-369"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to trigger a denial of service via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16897 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16897.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16897"
    },
    {
      "cve": "CVE-2026-16901",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling remote attackers to execute arbitrary code via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16901 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16901.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16901"
    },
    {
      "cve": "CVE-2026-16903",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a vulnerability involving an out-of-bounds write that could enable remote code execution or denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16903 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16903.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16903"
    },
    {
      "cve": "CVE-2026-16909",
      "cwe": {
        "id": "CWE-128",
        "name": "Wrap-around Error"
      },
      "notes": [
        {
          "category": "other",
          "text": "Wrap-around Error",
          "title": "CWE-128"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an off-by-one bounds checking error that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16909 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16909.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16909"
    },
    {
      "cve": "CVE-2026-16911",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack buffer overflow vulnerability that enables remote authenticated attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16911 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16911.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16911"
    },
    {
      "cve": "CVE-2026-16913",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16913 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16913.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16913"
    },
    {
      "cve": "CVE-2026-16914",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling local attackers to execute arbitrary code via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16914 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16914.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16914"
    },
    {
      "cve": "CVE-2026-16917",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16917 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16917.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16917"
    },
    {
      "cve": "CVE-2026-16919",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
          "title": "CWE-843"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper validation of network-supplied pointers, enabling remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16919 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16919.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16919"
    },
    {
      "cve": "CVE-2026-16922",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "other",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
          "title": "CWE-367"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a TOCTOU race condition vulnerability that enables local attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16922 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16922.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16922"
    },
    {
      "cve": "CVE-2026-16923",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to escalate privileges due to improper privilege management.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16923 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16923.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16923"
    },
    {
      "cve": "CVE-2026-16924",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Underflow (Wrap or Wraparound)",
          "title": "CWE-191"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability where improper memory offset calculation during IPsec decapsulation allows a remote attacker to cause a denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16924 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16924.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16924"
    },
    {
      "cve": "CVE-2026-16925",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a local privilege escalation vulnerability caused by improper authorization controls.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16925 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16925.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16925"
    },
    {
      "cve": "CVE-2026-16926",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "notes": [
        {
          "category": "other",
          "text": "External Control of File Name or Path",
          "title": "CWE-73"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to overwrite arbitrary files by exploiting improper neutralization of special elements in input.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16926 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16926.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16926"
    },
    {
      "cve": "CVE-2026-16927",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "other",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
          "title": "CWE-367"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a TOCTOU race condition vulnerability that allows local attackers to escalate privileges to root.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16927 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16927.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16927"
    },
    {
      "cve": "CVE-2026-16928",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a heap-based buffer overflow vulnerability that can be exploited remotely to cause a denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16928 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16928.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16928"
    },
    {
      "cve": "CVE-2026-16932",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to execute arbitrary commands by exploiting improper validation of the ODMDIR environment variable.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16932 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16932.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16932"
    },
    {
      "cve": "CVE-2026-16934",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a heap-based buffer overflow vulnerability that enables local attackers to escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16934 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16934.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16934"
    },
    {
      "cve": "CVE-2026-16935",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "other",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
          "title": "CWE-367"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a TOCTOU race condition vulnerability that enables local attackers to escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16935 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16935.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16935"
    },
    {
      "cve": "CVE-2026-16936",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that permits local attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16936 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16936.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16936"
    },
    {
      "cve": "CVE-2026-16937",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to escalate privileges due to improper privilege management.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16937 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16937.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16937"
    },
    {
      "cve": "CVE-2026-16943",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a heap-based buffer overflow vulnerability that enables local attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16943 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16943.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16943"
    },
    {
      "cve": "CVE-2026-16944",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack-based buffer overflow vulnerability that enables local attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16944 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16944.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16944"
    },
    {
      "cve": "CVE-2026-16945",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack-based buffer overflow vulnerability that enables local attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16945 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16945.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16945"
    },
    {
      "cve": "CVE-2026-16946",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables local attackers to escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16946 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16946.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16946"
    },
    {
      "cve": "CVE-2026-16951",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap-based buffer overflow vulnerability that enables local authenticated attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16951 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16951.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16951"
    },
    {
      "cve": "CVE-2026-16952",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits a local attacker to cause denial of service by exhausting system resources.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16952 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16952.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16952"
    },
    {
      "cve": "CVE-2026-16958",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits remote attackers to cause a denial of service via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16958 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16958.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16958"
    },
    {
      "cve": "CVE-2026-16964",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables remote attackers to intercept messages and forge replies by exposing sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16964 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16964.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16964"
    },
    {
      "cve": "CVE-2026-16972",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper authentication that could allow remote attackers to access sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16972 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16972.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16972"
    },
    {
      "cve": "CVE-2026-16973",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits a local attacker to perform an out-of-bounds read, potentially disclosing sensitive kernel memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16973 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16973.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16973"
    },
    {
      "cve": "CVE-2026-16980",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
          "title": "CWE-59"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper symbolic link validation that allows a local attacker to cause a denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16980 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16980.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16980"
    },
    {
      "cve": "CVE-2026-16989",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
          "title": "CWE-59"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability involving improper symbolic link resolution that permits local attackers to escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16989 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16989.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16989"
    },
    {
      "cve": "CVE-2026-16991",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability involving improper symbolic link handling that may allow local attackers to escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16991 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16991.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16991"
    },
    {
      "cve": "CVE-2026-16996",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer underflow vulnerability that enables local attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16996 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16996.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16996"
    },
    {
      "cve": "CVE-2026-16997",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper privilege management that allows local attackers to execute arbitrary commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16997 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16997.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-16997"
    },
    {
      "cve": "CVE-2026-17000",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to execute arbitrary code due to improper authentication mechanisms.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17000 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17000.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17000"
    },
    {
      "cve": "CVE-2026-17003",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an out-of-bounds write vulnerability that could enable remote attackers to compromise system confidentiality and integrity.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17003 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17003.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17003"
    },
    {
      "cve": "CVE-2026-17006",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a heap buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17006 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17006.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17006"
    },
    {
      "cve": "CVE-2026-17007",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling local attackers to perform out-of-bounds reads, potentially exposing sensitive information or causing denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17007 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17007.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17007"
    },
    {
      "cve": "CVE-2026-17009",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability allowing local attackers to cause denial of service via NULL pointer dereference.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17009 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17009.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17009"
    },
    {
      "cve": "CVE-2026-17024",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper certificate validation that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17024 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17024.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17024"
    },
    {
      "cve": "CVE-2026-17040",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17040 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17040.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17040"
    },
    {
      "cve": "CVE-2026-17060",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a kernel heap over-read vulnerability that enables remote attackers to access sensitive data and cause denial of service conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17060 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17060.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17060"
    },
    {
      "cve": "CVE-2026-17118",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a use-after-free vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17118 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17118.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17118"
    },
    {
      "cve": "CVE-2026-17120",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a buffer overflow vulnerability that may enable remote attackers to cause denial of service conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17120 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17120.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17120"
    },
    {
      "cve": "CVE-2026-17121",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that enables remote attackers to cause a denial of service via uncontrolled recursion.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17121 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17121.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17121"
    },
    {
      "cve": "CVE-2026-17122",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a stack-based buffer overflow vulnerability enabling remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17122 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17122.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17122"
    },
    {
      "cve": "CVE-2026-17124",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to an out-of-bounds read that allows local attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17124 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17124.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17124"
    },
    {
      "cve": "CVE-2026-17136",
      "cwe": {
        "id": "CWE-134",
        "name": "Use of Externally-Controlled Format String"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Externally-Controlled Format String",
          "title": "CWE-134"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a format string vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17136 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17136.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17136"
    },
    {
      "cve": "CVE-2026-17138",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a stack-based buffer overflow vulnerability enabling remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17138 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17138.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17138"
    },
    {
      "cve": "CVE-2026-17141",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17141 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17141.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17141"
    },
    {
      "cve": "CVE-2026-17142",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to execute arbitrary commands due to improper authentication mechanisms.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17142 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17142.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17142"
    },
    {
      "cve": "CVE-2026-17145",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper privilege management that allows remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17145 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17145.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17145"
    },
    {
      "cve": "CVE-2026-17152",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17152 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17152.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17152"
    },
    {
      "cve": "CVE-2026-17157",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that enables remote attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17157 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17157.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17157"
    },
    {
      "cve": "CVE-2026-17159",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that enables remote attackers to trigger a denial of service via an integer overflow.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17159 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17159.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17159"
    },
    {
      "cve": "CVE-2026-17160",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer overflow vulnerability during size computation that could enable remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17160 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17160.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17160"
    },
    {
      "cve": "CVE-2026-17163",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper validation of an array size field, enabling remote attackers to cause a denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17163 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17163.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17163"
    },
    {
      "cve": "CVE-2026-17165",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that allows remote attackers to cause a denial of service via a NULL pointer dereference.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17165 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17165.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17165"
    },
    {
      "cve": "CVE-2026-17168",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a stack-based buffer overflow vulnerability enabling remote authenticated attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17168 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17168.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17168"
    },
    {
      "cve": "CVE-2026-17170",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability due to improper allocation size validation that could enable a remote attacker to cause a denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17170 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17170.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17170"
    },
    {
      "cve": "CVE-2026-17171",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
          "title": "CWE-59"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to overwrite arbitrary files by exploiting improper symbolic link handling.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17171 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17171.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17171"
    },
    {
      "cve": "CVE-2026-17195",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a vulnerability that permits a local attacker to trigger a denial of service via an out-of-bounds write.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17195 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17195.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17195"
    },
    {
      "cve": "CVE-2026-17422",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that permits local attackers to execute arbitrary code on affected systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17422 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17422.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17422"
    },
    {
      "cve": "CVE-2026-17423",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability involving an out-of-bounds read that may enable remote attackers to access sensitive data and cause denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17423 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17423.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17423"
    },
    {
      "cve": "CVE-2026-17424",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote attackers to bypass security restrictions by improperly limiting pathname access to restricted directories.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17424 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17424.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17424"
    },
    {
      "cve": "CVE-2026-17425",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack buffer overflow vulnerability that can be exploited remotely to cause a denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17425 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17425.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17425"
    },
    {
      "cve": "CVE-2026-17436",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a heap-based buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17436 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17436.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17436"
    },
    {
      "cve": "CVE-2026-18670",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an integer underflow vulnerability that may enable remote attackers to cause denial of service and potentially access sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18670 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18670.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18670"
    },
    {
      "cve": "CVE-2026-18716",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability enabling remote authenticated attackers to perform out-of-bounds reads, potentially exposing sensitive information or causing denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18716 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18716.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18716"
    },
    {
      "cve": "CVE-2026-18822",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that enables local attackers to cause denial of service by exhausting resources during directory record parsing.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18822 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18822.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18822"
    },
    {
      "cve": "CVE-2026-18824",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote authenticated attackers to execute arbitrary commands via improper neutralization of special elements in OS commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18824 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18824.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18824"
    },
    {
      "cve": "CVE-2026-18828",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a stack-based buffer overflow vulnerability that can be exploited remotely to cause a denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18828 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18828.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18828"
    },
    {
      "cve": "CVE-2026-18832",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a heap-based buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18832 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18832.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18832"
    },
    {
      "cve": "CVE-2026-18835",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits remote authenticated attackers to execute arbitrary commands via improper neutralization of special elements in OS commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18835 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18835.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18835"
    },
    {
      "cve": "CVE-2026-18840",
      "cwe": {
        "id": "CWE-822",
        "name": "Untrusted Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "Untrusted Pointer Dereference",
          "title": "CWE-822"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that permits local attackers to execute arbitrary code by exploiting improper validation of an attacker-controlled pointer.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18840 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18840.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18840"
    },
    {
      "cve": "CVE-2026-18842",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain an out-of-bounds write vulnerability that allows local attackers to escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18842 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18842.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18842"
    },
    {
      "cve": "CVE-2026-19437",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a buffer overflow vulnerability that enables remote attackers to execute arbitrary code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-19437 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19437.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-19437"
    },
    {
      "cve": "CVE-2026-19442",
      "cwe": {
        "id": "CWE-822",
        "name": "Untrusted Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "Untrusted Pointer Dereference",
          "title": "CWE-822"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 have a pointer validation flaw in the AIX Virtual SCSI initiator driver that can lead to denial of service, privilege escalation, or full kernel compromise of the client LPAR.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-19442 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19442.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-19442"
    },
    {
      "cve": "CVE-2026-19446",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 are susceptible to a remote unauthenticated denial-of-service attack via crafted UDP packets targeting an RPC service, resulting in complete system unavailability and necessitating an LPAR restart.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-19446 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19446.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-19446"
    },
    {
      "cve": "CVE-2026-19448",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Uninitialized Resource",
          "title": "CWE-908"
        },
        {
          "category": "description",
          "text": "A stack memory corruption vulnerability in the AIX IPsec ESP decapsulation handler affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, potentially causing kernel stack corruption, system crashes, and denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-19448 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19448.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-19448"
    },
    {
      "cve": "CVE-2026-19449",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a local privilege escalation vulnerability in cmdnim that allows unprivileged users to execute code with root privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-19449 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19449.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-19449"
    },
    {
      "cve": "CVE-2026-19653",
      "notes": [
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability that allows a local attacker to cause denial of service by improperly handling memory page table configurations.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-19653 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19653.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-19653"
    },
    {
      "cve": "CVE-2026-19783",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a vulnerability where a crafted filesystem image triggers kernel memory corruption via an out-of-bounds kernel-stack write, risking system crashes or privilege escalation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-19783 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19783.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-19783"
    },
    {
      "cve": "CVE-2026-22007",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of a Broken or Risky Cryptographic Algorithm",
          "title": "CWE-327"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affecting Oracle Java SE, Oracle GraalVM, OpenJDK versions 8, 11, 17, 21, 25, CRaC JDK variants, IBM Db2, and Oracle Communications Cloud Native Core Certificate Management allow unauthorized data access, denial of service, and data modification via various attack vectors.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22007 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22007.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-22007"
    },
    {
      "cve": "CVE-2026-22013",
      "cwe": {
        "id": "CWE-319",
        "name": "Cleartext Transmission of Sensitive Information"
      },
      "notes": [
        {
          "category": "other",
          "text": "Cleartext Transmission of Sensitive Information",
          "title": "CWE-319"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities across Oracle Java SE, Oracle GraalVM, OpenJDK versions 8, 11, 17, 21, 25, CRaC JDK 17, 21, 25, IBM Java distributions, and Oracle Communications Cloud Native Core allow remote unauthenticated attackers to access sensitive data, cause denial of service, or modify data, with some requiring human interaction.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22013 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22013.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-22013"
    },
    {
      "cve": "CVE-2026-22016",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        },
        {
          "category": "description",
          "text": "Multiple critical vulnerabilities affect Oracle Java SE, Oracle GraalVM, OpenJDK (versions 8, 11, 17, 21, 25, 26), CRaC JDK (17, 21, 25), and Oracle Communications Cloud Native Core, enabling unauthorized data access, denial of service, and data modification with CVSS scores up to 7.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22016 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22016.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-22016"
    },
    {
      "cve": "CVE-2026-22018",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "Multiple authentication, integer handling, and access control vulnerabilities in various OpenJDK, CRaC JDK, Oracle Java SE, Oracle GraalVM, and Oracle Communications products allow unauthenticated remote attackers to cause denial of service, unauthorized access, data modification, or data leakage.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22018 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22018.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-22018"
    },
    {
      "cve": "CVE-2026-22021",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Recursion",
          "title": "CWE-674"
        },
        {
          "category": "description",
          "text": "Multiple authentication, integer handling, and denial of service vulnerabilities affect various versions of Oracle Java SE, Oracle GraalVM, OpenJDK, CRaC JDK, IBM Java distributions, IBM Db2, and Oracle Communications Cloud Native Core Certificate Management, allowing unauthenticated attackers network access to cause partial denial of service, unauthorized data access, or data modification.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22021 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22021.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-22021"
    },
    {
      "cve": "CVE-2026-34268",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of a Broken or Risky Cryptographic Algorithm",
          "title": "CWE-327"
        },
        {
          "category": "description",
          "text": "Multiple authentication, integer handling, and access control vulnerabilities affect various Oracle Java SE, OpenJDK, CRaC JDK, and Oracle Communications products, enabling unauthenticated attackers to gain unauthorized data access, cause denial of service, or modify data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-34268 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34268.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-34268"
    },
    {
      "cve": "CVE-2026-41254",
      "cwe": {
        "id": "CWE-696",
        "name": "Incorrect Behavior Order"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Behavior Order",
          "title": "CWE-696"
        },
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Little CMS, including integer overflows in the CubeSize function, affect various versions of Little CMS and Oracle Java SE products, enabling denial of service, information disclosure, and potential code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-41254 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41254.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-41254"
    },
    {
      "cve": "CVE-2026-46968",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Oracle Java SE and OpenJDK versions, including JSSE component flaws and client certificate verification issues, allow unauthenticated attackers network access via TLS to cause information disclosure, denial of service, and unauthorized data modification.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-46968 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-46968.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-46968"
    },
    {
      "cve": "CVE-2026-47010",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "Multiple security vulnerabilities affecting Oracle Java SE, Oracle GraalVM, and various OpenJDK versions allow unauthenticated network attackers to cause information disclosure, denial of service, and unauthorized data modification with CVSS scores around 3.7.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47010 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47010.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-47010"
    },
    {
      "cve": "CVE-2026-47021",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inefficient Regular Expression Complexity",
          "title": "CWE-1333"
        },
        {
          "category": "description",
          "text": "Multiple security vulnerabilities affecting Oracle Java SE, Oracle GraalVM, and OpenJDK versions include denial of service, information disclosure, and unauthorized data access via various components and protocols.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47021 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47021.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-47021"
    },
    {
      "cve": "CVE-2026-47027",
      "notes": [
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Oracle Java SE and OpenJDK, including denial of service, information disclosure, and unauthorized data access, affect various versions and components such as SignatureFileVerifier and TLS protocols.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47027 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47027.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-47027"
    },
    {
      "cve": "CVE-2026-47057",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Oracle Java SE versions 8u491, 8u491-perf, and 11.0.31, including an integer overflow in OpenJDK\u0027s TypedArray.prototype.set(), allow unauthenticated network attackers to cause denial of service and unauthorized data access.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47057 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47057.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-47057"
    },
    {
      "cve": "CVE-2026-47058",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Oracle Java SE versions 8u491, 8u491-perf, and 11.0.31, as well as OpenJDK 11.0.32, allow unauthenticated network attackers to compromise data confidentiality, integrity, and cause out-of-bounds memory access with a CVSS score up to 7.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47058 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47058.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-47058"
    },
    {
      "cve": "CVE-2026-47059",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "Multiple security vulnerabilities in Oracle Java SE, Oracle GraalVM, and OpenJDK versions allow unauthenticated attackers to cause partial denial of service and unauthorized data access, primarily affecting sandboxed Java client deployments.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47059 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47059.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-47059"
    },
    {
      "cve": "CVE-2026-47063",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Verification of Cryptographic Signature",
          "title": "CWE-347"
        },
        {
          "category": "description",
          "text": "Multiple critical vulnerabilities in Oracle Java SE, GraalVM, and OpenJDK versions allow unauthenticated network attackers to modify or delete data, cause denial of service, and exploit flaws in APIs and JAR file signing.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47063 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47063.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-47063"
    },
    {
      "cve": "CVE-2026-48959",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inefficient Algorithmic Complexity",
          "title": "CWE-407"
        },
        {
          "category": "description",
          "text": "IO::Uncompress::Unzip versions prior to 2.220 for Perl contain a vulnerability in the fastForward() function that causes a per-byte read loop, leading to CPU exhaustion when processing malicious zip files.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-48959 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48959.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-48959"
    },
    {
      "cve": "CVE-2026-48962",
      "cwe": {
        "id": "CWE-95",
        "name": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
          "title": "CWE-95"
        },
        {
          "category": "other",
          "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
          "title": "CWE-94"
        },
        {
          "category": "description",
          "text": "IO::Compress versions before 2.220 for Perl contain a critical vulnerability in File::GlobMapper that allows arbitrary code execution via a maliciously crafted output glob.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-48962 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48962.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-48962"
    },
    {
      "cve": "CVE-2026-59995",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "other",
          "text": "Relative Path Traversal",
          "title": "CWE-23"
        },
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "description",
          "text": "OpenSSH versions prior to 10.4 contain multiple vulnerabilities including improper file placement by sftp and scp clients, argument handling flaws, authentication bypasses, and a use-after-free bug, potentially leading to data disclosure, modification, or denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-59995 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59995.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-59995"
    },
    {
      "cve": "CVE-2026-59996",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "other",
          "text": "Relative Path Traversal",
          "title": "CWE-23"
        },
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "description",
          "text": "OpenSSH versions prior to 10.4 contain multiple vulnerabilities including an scp flaw that places files in unintended parent directories during remote-to-remote copies, along with other issues affecting sftp, internal-sftp, GSSAPI options, forwarding, authentication, and client memory management.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-59996 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59996.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-59996"
    },
    {
      "cve": "CVE-2026-59997",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Specified Quantity in Input",
          "title": "CWE-1284"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
          "title": "CWE-88"
        },
        {
          "category": "description",
          "text": "OpenSSH versions prior to 10.4 contain multiple vulnerabilities including internal-sftp\u0027s limitation to nine command-line arguments, improper file location constraints, undocumented GSSAPI behavior, and authentication bypasses, potentially leading to data disclosure, modification, or DoS.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-59997 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59997.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-59997"
    },
    {
      "cve": "CVE-2026-59999",
      "cwe": {
        "id": "CWE-348",
        "name": "Use of Less Trusted Source"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Less Trusted Source",
          "title": "CWE-348"
        },
        {
          "category": "other",
          "text": "Improperly Implemented Security Check for Standard",
          "title": "CWE-358"
        },
        {
          "category": "description",
          "text": "OpenSSH versions prior to 10.4 contain multiple vulnerabilities including a failure of DisableForwarding=yes to override PermitTunnel=yes, leading to unauthorized network tunneling and other security issues such as improper file constraints, argument handling flaws, and client use-after-free bugs.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-59999 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59999.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-59999"
    },
    {
      "cve": "CVE-2026-60000",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "other",
          "text": "Improper Restriction of Excessive Authentication Attempts",
          "title": "CWE-307"
        },
        {
          "category": "description",
          "text": "OpenSSH versions prior to 10.4 contain multiple vulnerabilities including improper MaxAuthTries handling during GSSAPIAuthentication, argument and file location issues in sftp/scp, and a client use-after-free flaw, leading to denial of service, data modification, or information disclosure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60000 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60000.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60000"
    },
    {
      "cve": "CVE-2026-60001",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "other",
          "text": "Improper Restriction of Excessive Authentication Attempts",
          "title": "CWE-307"
        },
        {
          "category": "description",
          "text": "OpenSSH versions prior to 10.4 contain multiple vulnerabilities including inconsistent enforcement of minimum authentication delay, improper file location constraints, argument handling flaws, and a use-after-free during host key re-exchange, enabling unauthorized access, brute-force attacks, and potential code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60001 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60001.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60001"
    },
    {
      "cve": "CVE-2026-60002",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "other",
          "text": "Expired Pointer Dereference",
          "title": "CWE-825"
        },
        {
          "category": "description",
          "text": "OpenSSH versions prior to 10.4 contain multiple vulnerabilities including a critical client-side use-after-free flaw during host key re-exchange, along with issues in sftp, scp, argument handling, configuration enforcement, and authentication bypasses.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60002 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60002.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60002"
    },
    {
      "cve": "CVE-2026-60147",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Oracle Java SE, Oracle GraalVM, and OpenJDK affect various versions, allowing unauthenticated network attackers to gain unauthorized data access, cause denial of service, and exploit certificate validation flaws.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60147 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60147.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60147"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Loading…