rootpwn

low · CVSS v3 3.7

CVE-2026-18173

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive informati…

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication.

Scores

Severity
low
CVSS v2
2.6
CVSS v3
3.7
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

low

CVE-2026-85220

Thinkst Canary honeypots with the Redis service enabled are vulnerable to an unauthenticated remote denial‑of‑service attack. The flaw allows attackers to crash the Redis process, disrupting the honeypot’s availability. Thinkst has released patches for all supported platforms, including a new Docker image.

View analysis

low

CVE-2026-95818

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

View analysis

low

CVE-2026-85219

Thinkst Canary's OpenCanary 0.9.9 contains a Redis module flaw that lets an unauthenticated attacker trigger a denial-of-service by exhausting memory. The issue can be exploited remotely without credentials. It affects deployments running the default Redis module.

View analysis

low

CVE-2026-49449

Joplin note‑taking app (v1.4.0‑3.7.2) allows a note author to embed a KaTeX \"\href\" URL that bypasses the normal URL allowlist. On Windows, clicking such a link to an attacker‑controlled UNC path triggers SMB authentication and leaks the current user’s NTLMv2 challenge‑response. The flaw exposes user credentials without any warning.

View analysis