Filtered by vendor Ibm
Subscriptions
Total
8754 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-9006 | 3 Ibm, Linux, Microsoft | 6 Aix, I, Websphere Application Server and 3 more | 2026-06-23 | 7.4 High |
| IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure. | ||||
| CVE-2026-9071 | 4 Apple, Ibm, Linux and 1 more | 8 Macos, Aix, I and 5 more | 2026-06-23 | 7.5 High |
| IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. | ||||
| CVE-2024-51454 | 1 Ibm | 1 Engineering Workflow Management | 2026-06-22 | 6.5 Medium |
| IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. | ||||
| CVE-2026-8059 | 1 Ibm | 2 Datacap, Datacap Navigator | 2026-06-22 | 6.1 Medium |
| IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2026-11372 | 1 Ibm | 1 Tririga Application Platform | 2026-06-22 | 5.4 Medium |
| IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2026-10845 | 3 Ibm, Linux, Microsoft | 6 Aix, I, Websphere Application Server and 3 more | 2026-06-22 | 7.3 High |
| IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications. | ||||
| CVE-2024-54178 | 1 Ibm | 5 Cloud Pak For Data, Db2, Db2 On Cloud Pak For Data and 2 more | 2026-06-22 | 6.5 Medium |
| IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to improper allocation of resources. | ||||
| CVE-2026-8636 | 1 Ibm | 2 Datacap, Datacap Navigator | 2026-06-22 | 5.5 Medium |
| IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database. | ||||
| CVE-2026-9320 | 4 Apple, Ibm, Linux and 1 more | 8 Macos, Aix, I and 5 more | 2026-06-22 | 5.9 Medium |
| IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. | ||||
| CVE-2026-8646 | 4 Apple, Ibm, Linux and 1 more | 8 Macos, Aix, I and 5 more | 2026-06-22 | 7.4 High |
| IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information. | ||||
| CVE-2026-9610 | 1 Ibm | 2 Datacap, Datacap Navigator | 2026-06-22 | 2.3 Low |
| IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls. | ||||
| CVE-2025-2669 | 1 Ibm | 5 Cloud Pak For Data, Db2, Db2 On Cloud Pak For Data and 2 more | 2026-06-22 | 6 Medium |
| IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation. | ||||
| CVE-2026-4870 | 1 Ibm | 3 Qiskit, Qiskit Sdk, Qiskit Software Development Kit | 2026-06-16 | 7.5 High |
| IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segmentation fault leading to a denial of service due to uncontrolled recursion in the parser. | ||||
| CVE-2024-45636 | 1 Ibm | 1 Security Qradar Edr | 2026-06-16 | 4.1 Medium |
| IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user. | ||||
| CVE-2026-3341 | 2 Ibm, Langflow | 2 Langflow Desktop, Langflow Desktop | 2026-06-16 | 5.4 Medium |
| IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | ||||
| CVE-2026-4096 | 2 Hcltech, Ibm | 2 Devops Plan, Devops Plan | 2026-06-16 | 6.5 Medium |
| IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking | ||||
| CVE-2026-7870 | 1 Ibm | 1 I | 2026-06-16 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. | ||||
| CVE-2026-7787 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-06-16 | 7.5 High |
| IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references. | ||||
| CVE-2026-7876 | 1 Ibm | 2 Aspera High-speed Transfer Server For Cloud Pak For Integration, Aspera Hsts For Cp4i | 2026-06-11 | 9.1 Critical |
| IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place. | ||||
| CVE-2026-9170 | 1 Ibm | 2 Http Server, Web Server Plug Ins For Websphere Application Server And Websphere Liberty | 2026-06-11 | 9.8 Critical |
| IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation. | ||||