CVE-2026-9038

IBM Concert 1.0 through 3.0.1.1 allows an attacker to supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.

IBM Optim versions 1.0.0, 1.1.0, and 1.2.0 are vulnerable to path traversal, allowing a remote authenticated attacker to obtain sensitive information.

IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.

IBM Process Mining 2.0.0 through 2.2.1 has improper access control, which could allow a remote attacker to obtain sensitive information.

IBM DataStage on Cloud Pak for Data 5.4.0.0 has an absolute-path traversal vulnerability that could allow a remote authenticated attacker to obtain sensitive information.

The Melapress Role Editor plugin for WordPress (through version 1.3.0) contains an incorrect privilege assignment vulnerability that allows privilege escalation. A low-privileged user can gain a higher level of access within the system.

IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 have an improper Content Security Policy configuration that could allow a remote attacker to bypass security restrictions. The flaw concerns browser-side protection mechanisms.

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution.