CVE-2026-15061

HighCVSS 8.2/10Last modified Aug 20, 2026

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2026
Last modified
Aug 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-150629.6SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-CVE-2026-150636.3A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorCVE-2026-150648.7IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper hanCVE-2026-150659.1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of interCVE-2026-150666.4The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, aCVE-2026-150678.8Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized dCVE-2026-150689.9IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper CVE-2026-150695.4IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralizationCVE-2026-15077.5The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI serviceCVE-2026-150708.8The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includinCVE-2026-150726.5The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameCVE-2026-150736.5The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parame
CVE-2026-15061: High severity, CVSS 8.2 | Vulnix