CVE-2026-6715

CriticalCVSS 9.8/10Last modified Nov 10, 2026

Description

IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 8, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-671655.4HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in CVE-2026-671715.3HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive inter CVE-2026-671723.7HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error CVE-2026-671735.1Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An a CVE-2026-671749.2Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The try CVE-2026-671754.6Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in CVE-2026-671765.4Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a craf CVE-2026-671775.4Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username fie CVE-2026-671787.8MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: R CVE-2026-671797.8Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS r CVE-2026-67186.2IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files.CVE-2026-671808.4Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence