CVE-2026-11806

HighCVSS 7.5/10Last modified Jul 2, 2026

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2026
Last modified: Jul 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-118079.6A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint d CVE-2026-118093.7The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_prob CVE-2026-11819.0Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credential CVE-2026-118107.5The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata CVE-2026-118113.7The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on CVE-2026-118122.5The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structu CVE-2026-118137.8A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated us CVE-2026-118146.8A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify l CVE-2026-118155.3An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize CVE-2026-118168.1Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file CVE-2026-118175.3This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In CVE-2026-118185.4The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all