CVE Watch28 jul 2026

CVE-2026-4932

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Tran

CVSS

4.2

Medio

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 28 jul 2026 · Última mod.: 28 jul 2026 · CWE-331

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.

Referencias oficiales

www.ibm.comhttps://www.ibm.com/support/pages/node/7280632

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-11403—

27.6%

——8A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.14d CVE-2026-131994.0 MED

1.8%

——1EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.22d CVE-2026-464737.5 ALT

34.2%

——10Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.6d CVE-2026-72107.5 ALT

52.6%

——16`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.2d CVE-2026-410802.9 BAJ

32.5%

——10libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.15d CVE-2024-535227.5 ALT

50.7%

——15Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information.24d