CVE-2026-19442

HighCVSS 8.8/10Last modified Aug 25, 2026

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in denial of service, privilege escalation, or full compromise of the client LPAR kernel.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-822

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2026
Last modified: Aug 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-194446.5A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a co CVE-2026-194459.2A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context CVE-2026-194467.5IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC serv CVE-2026-194475.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade I CVE-2026-194487.5IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Suc CVE-2026-194498.8IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payloa CVE-2026-19457.2The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb_user_name' and 'wpb_user_email' parameters in al CVE-2026-194537.1The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or mig CVE-2026-194544.4The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job lo CVE-2026-19464.3The GW AI Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the g CVE-2026-19477.5The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions u CVE-2026-194716.9Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitize