CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-80424 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a...

·Source: NIST NVD

Updated:

Executive Summary

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.

Analysis

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction. CVSS Score: 9.1. Published: 2026-09-10T22:17:01.163.

Indicators of Compromise (2)

CVE (1)
CVE-2026-80424
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Microsoft sees some new wrinkles in invoice-scam emails

Researchers analyzed a flood of fraudulent business emails and found that the threat actors had doubled-up on tactics to make them appear legitimate, including help from AI.

The Record
CRITICALVulnerability

NVD CRITICAL: CVE-2026-72710 — SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_...

SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spip_jobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and execute

CVE-2026-72710
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-72709 — SPIP before 4.4.18 contains a missing authorization vulnerability in the adminis...

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_au

CVE-2026-72709
NIST NVD