WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor ibm✕
Overview 9,190 matches · 533 in Waratek scope · 53 protected · 29 exploited · 11 CISA KEV · 270 public PoC · 43 EPSS ≥ 0.5
split by peak 1,250 / year
Not applicable: 8,553Outside Waratek scope: 104No exploit published: 472Mitigation candidate: 8Protected by Waratek: 53 Low: 673Medium: 5,089High: 2,883Critical: 545 not blocked: 9,137blocked by ARMR today: 53 No public exploit: 8,897Forecast only: 5Proof of concept only: 14Working exploit published: 245Exploited: 29
19924 Not applicable4 High3 Low1 not blocked4 No public exploit4 19930 19944 Not applicable4 High4 not blocked4 Working exploit published1 No public exploit3 19952 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 199612 Not applicable12 High7 Medium4 Low1 not blocked12 Working exploit published5 No public exploit7 199731 Not applicable31 High22 Medium8 Low1 not blocked31 Working exploit published13 No public exploit18 199820 Not applicable20 High11 Medium7 Low2 not blocked20 Working exploit published6 No public exploit14 199922 No exploit published1 Not applicable21 High14 Medium4 Low4 not blocked22 Working exploit published10 No public exploit12 200017 Mitigation candidate1 No exploit published1 Outside Waratek scope1 Not applicable14 High10 Medium5 Low2 not blocked17 Working exploit published6 No public exploit11 200159 Mitigation candidate1 No exploit published4 Outside Waratek scope1 Not applicable53 High32 Medium26 Low1 not blocked59 Exploited2 Working exploit published14 No public exploit43 200243 No exploit published1 Not applicable42 High23 Medium16 Low4 not blocked43 Exploited1 Working exploit published7 No public exploit35 200331 No exploit published1 Not applicable30 High18 Medium12 Low1 not blocked31 Exploited2 Working exploit published5 No public exploit24 200450 Outside Waratek scope2 Not applicable48 High29 Medium18 Low3 not blocked50 Working exploit published15 No public exploit35 200577 Mitigation candidate1 No exploit published8 Not applicable68 High34 Medium32 Low11 not blocked77 Working exploit published12 No public exploit65 200690 Mitigation candidate1 No exploit published21 Outside Waratek scope1 Not applicable67 High37 Medium46 Low7 not blocked90 Working exploit published8 No public exploit82 2007134 Mitigation candidate1 No exploit published18 Not applicable115 High70 Medium56 Low8 not blocked134 Exploited1 Working exploit published11 No public exploit122 2008147 No exploit published15 Not applicable132 High72 Medium67 Low8 not blocked147 Working exploit published7 No public exploit140 2009172 Mitigation candidate1 No exploit published42 Outside Waratek scope1 Not applicable128 High74 Medium83 Low15 not blocked172 Working exploit published20 No public exploit152 2010203 No exploit published27 Outside Waratek scope1 Not applicable175 High57 Medium130 Low16 not blocked203 Working exploit published26 No public exploit177 2011169 Protected by Waratek1 Mitigation candidate1 No exploit published27 Outside Waratek scope1 Not applicable139 High49 Medium99 Low21 blocked by ARMR today1 not blocked168 Working exploit published11 No public exploit158 2012175 Protected by Waratek1 No exploit published23 Not applicable151 High45 Medium111 Low19 blocked by ARMR today1 not blocked174 Working exploit published16 No public exploit159 2013389 Protected by Waratek2 No exploit published40 Outside Waratek scope2 Not applicable345 High62 Medium236 Low91 blocked by ARMR today2 not blocked387 Working exploit published5 No public exploit384 2014465 Protected by Waratek2 No exploit published32 Outside Waratek scope11 Not applicable420 Critical2 High57 Medium282 Low124 blocked by ARMR today2 not blocked463 Exploited5 Working exploit published15 Proof of concept only1 No public exploit444 2015315 No exploit published21 Outside Waratek scope3 Not applicable291 Critical1 High84 Medium148 Low82 not blocked315 Working exploit published4 Proof of concept only1 Forecast only1 No public exploit309 2016387 Protected by Waratek2 No exploit published14 Outside Waratek scope3 Not applicable368 Critical17 High98 Medium225 Low47 blocked by ARMR today2 not blocked385 Exploited2 Working exploit published3 No public exploit382 2017684 Protected by Waratek2 No exploit published13 Outside Waratek scope3 Not applicable666 Critical26 High161 Medium458 Low39 blocked by ARMR today2 not blocked682 Exploited3 Working exploit published9 No public exploit672 2018640 Protected by Waratek5 No exploit published22 Outside Waratek scope11 Not applicable602 Critical29 High178 Medium417 Low16 blocked by ARMR today5 not blocked635 Working exploit published7 No public exploit633 2019473 Protected by Waratek3 No exploit published15 Outside Waratek scope6 Not applicable449 Critical23 High125 Medium303 Low22 blocked by ARMR today3 not blocked470 Exploited3 Working exploit published2 No public exploit468 2020565 Protected by Waratek9 Mitigation candidate1 No exploit published12 Outside Waratek scope5 Not applicable538 Critical36 High166 Medium337 Low26 blocked by ARMR today9 not blocked556 Exploited6 Proof of concept only2 Forecast only3 No public exploit554 2021608 Protected by Waratek8 No exploit published5 Outside Waratek scope28 Not applicable567 Critical30 High159 Medium396 Low23 blocked by ARMR today8 not blocked600 Proof of concept only1 Forecast only1 No public exploit606 2022419 No exploit published14 Outside Waratek scope18 Not applicable387 Critical31 High110 Medium268 Low10 not blocked419 Proof of concept only2 No public exploit417 2023415 Protected by Waratek2 No exploit published9 Not applicable404 Critical34 High186 Medium191 Low4 blocked by ARMR today2 not blocked413 Exploited1 Working exploit published2 Proof of concept only1 No public exploit411 2024509 Protected by Waratek4 No exploit published17 Outside Waratek scope6 Not applicable482 Critical42 High154 Medium303 Low10 blocked by ARMR today4 not blocked505 Exploited2 Working exploit published4 Proof of concept only4 No public exploit499 2025609 Protected by Waratek1 No exploit published10 Not applicable598 Critical44 High181 Medium360 Low24 blocked by ARMR today1 not blocked608 Proof of concept only2 No public exploit607 20261,250 Protected by Waratek11 No exploit published59 Not applicable1,180 Critical230 High549 Medium441 Low30 blocked by ARMR today11 not blocked1,239 Exploited1 No public exploit1,249
199319961999200220052008201120142017202020232026
9,190 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 92 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-108178 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for.
CVE-2026-105459 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation.
CVE-2026-105002 High 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.
CVE-2026-82418 Critical 2026-11-04 Not applicable No public exploit IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.
CVE-2026-19319 Medium 2026-11-04 Not applicable No public exploit IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
CVE-2026-18142 High 2026-11-04 Not applicable No public exploit IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.
CVE-2026-17493 High 2026-11-04 Not applicable No public exploit IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
CVE-2026-16725 Medium 2026-11-04 Not applicable No public exploit IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path traversal.
CVE-2026-11724 High 2026-11-04 Not applicable No public exploit IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
CVE-2026-116376 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability.
CVE-2026-11376 High 2026-11-04 Not applicable No public exploit IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.
CVE-2026-110283 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers.
CVE-2026-110282 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control.
CVE-2026-110281 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique.
CVE-2026-108910 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step.
CVE-2026-108838 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-108767 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers.
CVE-2026-10859 High 2026-11-04 Not applicable No public exploit IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.
CVE-2026-108588 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing.
CVE-2026-108536 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.
CVE-2026-105991 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header.
CVE-2026-105702 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details.
CVE-2026-93744 Medium 2026-10-20 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.
CVE-2026-8355 Medium 2026-10-20 Not applicable No public exploit IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters.
CVE-2026-82891 High 2026-10-20 Not applicable No public exploit IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
CVE-2026-6930 High 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2026-6719 High 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2026-4418 Medium 2026-10-19 Not applicable No public exploit IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVE-2026-4413 Medium 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2026-4405 Medium 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.
CVE-2026-3628 Medium 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.
CVE-2026-3303 Low 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
CVE-2026-3295 High 2026-10-19 Not applicable No public exploit IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).
CVE-2026-3161 High 2026-10-19 Not applicable No public exploit IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2026-15661 Medium 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
CVE-2026-1510 Medium 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.
CVE-2026-1501 Low 2026-10-19 Not applicable No public exploit IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.
CVE-2026-14511 Medium 2026-10-19 Not applicable No public exploit IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications.
CVE-2026-12727 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.
CVE-2026-12670 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.
CVE-2026-12669 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
CVE-2026-12665 Critical 2026-10-19 Not applicable No public exploit IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.
CVE-2026-12660 Low 2026-10-19 Not applicable No public exploit IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.
CVE-2026-12350 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.
CVE-2026-12343 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations.
CVE-2026-12155 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.
CVE-2026-12148 High 2026-10-19 Not applicable No public exploit IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.
CVE-2026-11831 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.
CVE-2026-11829 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests.
CVE-2026-11828 Medium 2026-10-19 Not applicable No public exploit IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values.
CVE-2026-10743 High 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
CVE-2026-10574 High 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
CVE-2026-10572 High 2026-10-19 Not applicable No public exploit IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
CVE-2023-38375 Medium 2026-10-19 Not applicable No public exploit IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2026-17491 Medium 2026-10-16 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.
CVE-2026-17488 Medium 2026-10-16 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CVE-2026-17275 Medium 2026-10-16 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
CVE-2026-17073 Medium 2026-10-16 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
CVE-2026-17068 Medium 2026-10-16 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
CVE-2026-107674 Medium 2026-10-16 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections.
CVE-2026-102917 High 2026-10-16 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.
CVE-2026-96119 Critical 2026-10-13 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
CVE-2026-95696 High 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95695 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-93909 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93905 High 2026-10-13 Protected by Waratek No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-93895 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-93886 High 2026-10-13 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
CVE-2026-81858 High 2026-10-13 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
CVE-2026-18343 Medium 2026-10-13 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.
CVE-2026-18318 Medium 2026-10-13 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.
CVE-2026-17487 Medium 2026-10-13 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
CVE-2026-17484 Medium 2026-10-13 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.
CVE-2026-84418 High 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.
CVE-2026-82110 Critical 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
CVE-2026-82108 High 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVE-2026-82103 Critical 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.
CVE-2026-82101 Critical 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
CVE-2026-82096 High 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
CVE-2026-75063 Medium 2026-10-12 Not applicable No public exploit IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.
CVE-2026-75061 High 2026-10-12 Not applicable No public exploit IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.
CVE-2026-19627 High 2026-10-12 Not applicable No public exploit IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.
CVE-2026-19622 Critical 2026-10-12 Not applicable No public exploit IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
CVE-2026-19620 High 2026-10-12 Not applicable No public exploit IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.
CVE-2026-18541 Medium 2026-10-12 Not applicable No public exploit IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2026-17475 High 2026-10-12 Not applicable No public exploit IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.
CVE-2026-87980 Medium 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.
CVE-2026-84891 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.
CVE-2026-84875 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-84290 Medium 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.
CVE-2026-84278 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.
CVE-2026-84276 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.
CVE-2026-84275 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector.
CVE-2026-84274 Medium 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the relevant application or container logs could obtain these credentials and use them to impersonate services or gain unauthorized access to the Guardium control plane.
CVE-2026-84272 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.
CVE-2026-84271 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.
CVE-2026-84250 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges.
CVE-2026-84249 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
CVE-2026-84247 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
CVE-2026-84246 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
‹ prev page 2 of 92 next ›