CVE-2026-15065

CriticalCVSS 9.1/10Last modified Aug 20, 2026

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2026
Last modified: Aug 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-150666.4The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, a CVE-2026-150678.8Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized d CVE-2026-150689.9IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper CVE-2026-150695.4IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization CVE-2026-15077.5The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI service CVE-2026-150708.8The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin CVE-2026-150726.5The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parame CVE-2026-150736.5The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parame CVE-2026-150747.5@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution sta CVE-2026-150757.5In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates al CVE-2026-150767.5In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does CVE-2026-150774.3GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditi