CVE-2026-9745

MediumCVSS 6.5/10Last modified Sep 10, 2026

Description

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-283

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2026
Last modified: Sep 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-974508.4In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate ha CVE-2026-974518.4In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) Add CVE-2026-974528.4In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid references Prevent adding references fo CVE-2026-97453In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate byte_count in acpi_ps_get_next_package_length() Valid CVE-2026-974547.7In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in acpi_ps_get_next_field() Add boundary c CVE-2026-974558.4In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() Fix u CVE-2026-97456In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix condition check in acpi_ps_parse_loop() Fix condition chec CVE-2026-97466.5When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server t CVE-2026-974689.1Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of th CVE-2026-974694.3PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collect CVE-2026-97476.5Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.CVE-2026-974706.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Co