WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor ibm✕
Overview 545 matches · 44 in Waratek scope · 14 protected · 13 exploited · 9 CISA KEV · 17 public PoC · 14 EPSS ≥ 0.5
545matches 44in Waratek scope8.1% 14protected2.6% 13exploited2.4% 9CISA KEV1.7% 17public PoC3.1% 14EPSS ≥ 0.52.6%
Protected by Waratek 14 2.6% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 30 5.5% Outside Waratek scope 2 0.4% Not applicable 499 91.6% Withdrawn CVE 0 0.0%
Critical 545 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 14 2.6% partly blocked 0 0.0% not blocked 531 97.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 13 2.4% Working exploit published 5 0.9% Proof of concept only 2 0.4% Forecast only 1 0.2% No public exploit 524 96.1%
split by peak 230 / year
Not applicable: 499Outside Waratek scope: 2No exploit published: 30Protected by Waratek: 14 Critical: 545 not blocked: 531blocked by ARMR today: 14 No public exploit: 524Forecast only: 1Proof of concept only: 2Working exploit published: 5Exploited: 13
20142 Not applicable2 Critical2 not blocked2 Exploited2 20151 No exploit published1 Critical1 not blocked1 No public exploit1 201617 Protected by Waratek1 No exploit published1 Not applicable15 Critical17 blocked by ARMR today1 not blocked16 Exploited1 No public exploit16 201726 Protected by Waratek1 No exploit published1 Not applicable24 Critical26 blocked by ARMR today1 not blocked25 Exploited1 Working exploit published1 No public exploit24 201829 Protected by Waratek1 No exploit published3 Not applicable25 Critical29 blocked by ARMR today1 not blocked28 Working exploit published1 No public exploit28 201923 Protected by Waratek1 Not applicable22 Critical23 blocked by ARMR today1 not blocked22 Exploited1 Working exploit published2 No public exploit20 202036 Protected by Waratek3 Not applicable33 Critical36 blocked by ARMR today3 not blocked33 Exploited4 Forecast only1 No public exploit31 202130 Outside Waratek scope1 Not applicable29 Critical30 not blocked30 Proof of concept only1 No public exploit29 202231 Outside Waratek scope1 Not applicable30 Critical31 not blocked31 No public exploit31 202334 Protected by Waratek2 No exploit published2 Not applicable30 Critical34 blocked by ARMR today2 not blocked32 Exploited1 Working exploit published1 Proof of concept only1 No public exploit31 202442 Not applicable42 Critical42 not blocked42 Exploited2 No public exploit40 202544 Protected by Waratek1 Not applicable43 Critical44 blocked by ARMR today1 not blocked43 No public exploit44 2026230 Protected by Waratek4 No exploit published22 Not applicable204 Critical230 blocked by ARMR today4 not blocked226 Exploited1 No public exploit229
2014201620182020202220242026
545 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 6 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-17362 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.
CVE-2026-17301 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.
CVE-2026-17299 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker.
CVE-2026-17298 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17297 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
CVE-2026-17296 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17292 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.
CVE-2026-17291 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
CVE-2026-17280 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.
CVE-2026-17278 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party.
CVE-2026-17239 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vulnerability.
CVE-2026-17150 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.
CVE-2026-17147 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
CVE-2026-17134 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.
CVE-2026-17132 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-17131 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
CVE-2026-17117 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.
CVE-2026-17066 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.
CVE-2026-17049 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.
CVE-2026-16920 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.
CVE-2026-16918 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side request forgery.
CVE-2026-16884 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.
CVE-2026-16720 Critical 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.
CVE-2026-123218 Critical 2026-11-07 Not applicable Exploited IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
CVE-2026-82418 Critical 2026-11-04 Not applicable No public exploit IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.
CVE-2026-12665 Critical 2026-10-19 Not applicable No public exploit IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.
CVE-2026-96119 Critical 2026-10-13 Not applicable No public exploit IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
CVE-2026-95695 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-93909 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93895 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-82110 Critical 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
CVE-2026-82103 Critical 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.
CVE-2026-82101 Critical 2026-10-12 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
CVE-2026-19622 Critical 2026-10-12 Not applicable No public exploit IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
CVE-2026-84272 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.
CVE-2026-84249 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
CVE-2026-84246 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-84244 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated Guardium user.
CVE-2026-84209 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-84198 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-84058 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.
CVE-2026-84057 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
CVE-2026-84035 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-82900 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
CVE-2026-82895 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-82344 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.
CVE-2026-82335 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.
CVE-2026-82334 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.
CVE-2026-81932 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2026-80381 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
CVE-2026-78406 Critical 2026-10-08 Not applicable No public exploit IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-78401 Critical 2026-10-08 Not applicable No public exploit IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-75875 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
CVE-2026-19491 Critical 2026-10-08 Not applicable No public exploit IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.
CVE-2026-16916 Critical 2026-10-08 Not applicable No public exploit IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.
CVE-2026-16823 Critical 2026-10-08 Not applicable No public exploit IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.
CVE-2026-16340 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.
CVE-2026-15762 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
CVE-2026-14992 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.
CVE-2026-14991 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVE-2026-14988 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.
CVE-2026-14888 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.
CVE-2026-14508 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.
CVE-2026-14502 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.
CVE-2026-14269 Critical 2026-10-08 Not applicable No public exploit IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
CVE-2026-84436 Critical 2026-09-29 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges.
CVE-2026-81549 Critical 2026-09-24 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.
CVE-2026-6928 Critical 2026-09-23 Not applicable No public exploit IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.
CVE-2026-6730 Critical 2026-09-23 Not applicable No public exploit IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVE-2026-6721 Critical 2026-09-23 Not applicable No public exploit IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the affected application.
CVE-2026-18872 Critical 2026-09-23 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.
CVE-2026-18169 Critical 2026-09-22 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
CVE-2026-18163 Critical 2026-09-22 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.
CVE-2026-18162 Critical 2026-09-22 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
CVE-2026-17645 Critical 2026-09-22 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.
CVE-2026-17635 Critical 2026-09-22 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.
CVE-2026-17618 Critical 2026-09-22 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.
CVE-2026-17472 Critical 2026-09-22 Not applicable No public exploit IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.
CVE-2026-16346 Critical 2026-09-22 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
CVE-2026-84082 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-84078 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-balancer operations, potentially resulting in unauthorized actions and impact to the integrity and availability of the affected system.
CVE-2026-84075 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet.
CVE-2026-84073 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-84064 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-84031 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.
CVE-2026-82967 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface.
CVE-2026-82832 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.
CVE-2026-82340 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.
CVE-2026-81657 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-80442 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.
CVE-2026-80441 Critical 2026-09-18 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.
CVE-2026-10027 Critical 2026-09-18 Not applicable No public exploit IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.
CVE-2026-16338 Critical 2026-09-14 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
CVE-2026-82107 Critical 2026-09-10 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication.
CVE-2026-82100 Critical 2026-09-10 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
CVE-2026-80424 Critical 2026-09-10 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
CVE-2026-78573 Critical 2026-09-10 Not applicable No public exploit IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.
CVE-2026-77822 Critical 2026-09-04 Not applicable No public exploit IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
CVE-2026-18221 Critical 2026-09-04 Not applicable No public exploit IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
CVE-2026-17207 Critical 2026-09-04 Not applicable No public exploit IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow.
‹ prev page 1 of 6 next ›