CVE-2026-19651

HighCVSS 7.4/10Last modified Sep 9, 2026

Description

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	Enterprise Build of Quarkus	>= 3.27.1, <= 3.27.5; >= 3.33.1, <= 3.33.3

References

https://www.ibm.com/support/pages/node/7286498

Timeline

Published: Sep 8, 2026
Last modified: Sep 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-196529.8The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `CVE-2026-196535.5IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory p CVE-2026-196547.5A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversi CVE-2026-196556.5On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information opti CVE-2026-196569.9ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only l CVE-2026-196576.1ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim int CVE-2026-196589.8The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization CVE-2026-19662.4YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to CVE-2026-196609.8The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_pa CVE-2026-196625.9An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for CVE-2026-196667.5On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolve CVE-2026-196677.5If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in