CVE-2026-77153

MediumCVSS 4.8/10Last modified Nov 12, 2026

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 8, 2026
Last modified: Nov 12, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-771566.4Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal CVE-2026-771576.4ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its a CVE-2026-771595.5A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm l CVE-2026-77166.3A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the f CVE-2026-771616.5The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions CVE-2026-771646.2Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, CVE-2026-771656.5File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of CVE-2026-771662.4The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar CVE-2026-771677.5Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist ind CVE-2026-771684.3A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tra CVE-2026-771696.5A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only deleg CVE-2026-77178.8A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-b