Veille CVE

Mercredi 30 septembre 2026

9 CVE

Critique 1 Élevée 1 Moyenne 4 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM i » ✕
  1. CVE-2026-53708 6.6 Moyenne

    IBM mcp-context-forge · IBM mcp-contextforge-gateway

    ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validate_gateway_test_url() in mcpgateway/common/validators.py to resolve and reject private, loopback, link-local, and cloud-metadata addresses, but ResilientHttpClient later resolves the original hostname again without binding the validated address. When MCPGATEWAY_ADMIN_API_ENABLED is enabled, an attacker with a database-backed role containing explicit gateways.read permission can use DNS rebinding to return a public address during validation and a private or metadata address during connection, bypassing ssrf_blocked_networks and ssrf_dns_fail_closed because those controls apply only to the validation-time result. The endpoint's allow_admin_bypass=False setting means a bootstrap-only virtual platform-admin identity without a database role is not sufficient. Successful exploitation can reach internal services and cloud metadata, expose cloud credentials, access internal APIs, or probe internal network ports. This issue is fixed in version 1.0.3.

  2. CVE-2026-53710 10.0 Critique

    IBM mcp-context-forge

    MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.

  3. CVE-2026-17413 5.1 Moyenne

    IBM PowerVM Hypervisor · Ibm power system s1122 \(9824-22a\) firmware · Ibm power system s1124 \(9824-42a\) firmware · Ibm power system s1122s \(9824-22b\) firmware

    IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level (root) access to a logical partition can send a specially crafted request to partition firmware, causing the partition to crash and become unavailable. Other partitions on the same managed system are not affected.

  4. CVE-2026-17503 5.1 Moyenne

    IBM PowerVM Hypervisor · Ibm power system s1122 \(9824-22a\) firmware · Ibm power system s1124 \(9824-42a\) firmware · Ibm power system s1122s \(9824-22b\) firmware

    IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.

  5. CVE-2026-17511 3.4 Faible

    IBM PowerVM Hypervisor · Ibm power system s1122 \(9824-22a\) firmware · Ibm power system s1124 \(9824-42a\) firmware · Ibm power system s1122s \(9824-22b\) firmware

    IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service processor can obtain a limited snapshot of partition processor state. Successful exploitation results in a confidentiality impact to the managed system.

  6. CVE-2026-18857 3.4 Faible

    IBM OPENBMC · Ibm power system s1122 \(9824-22a\) firmware · Ibm power system s1124 \(9824-42a\) firmware · Ibm power system s1122s \(9824-22b\) firmware

    IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.

  7. CVE-2026-18870 4.3 Moyenne

    IBM PowerVM Hypervisor · Ibm power system s1122 \(9824-22a\) firmware · Ibm power system s1124 \(9824-42a\) firmware · Ibm power system s1122s \(9824-22b\) firmware

    IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

  8. CVE-2026-19492 3.2 Faible

    IBM PowerVM Hypervisor · Ibm power system s1122 \(9824-22a\) firmware · Ibm power system s1124 \(9824-42a\) firmware · Ibm power system s1122s \(9824-22b\) firmware

    IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call interface. An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing sensitive data belonging to the hypervisor or other guest partitions hosted on the same system, resulting in a confidentiality impact. The attacker has no control over which memory contents are returned. This vulnerability is of particular concern in multi-tenant environments where guests may run arbitrary OS images.

  9. CVE-2026-93306 7.1 Élevée

    IBM Server Firmware · Ibm power system e1080 \(9080-hex\) firmware · Ibm power system e1180 \(9080-heu\) firmware · Ibm power system s922 \(9009-22g\) firmware

    IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.