Ibm vulnerabilities
Published CVEs affecting Ibm products: 1338 record(s), with severity, exploitation and fixes.
Aix 156Vios 155I 146Guardium Data Protection 83Websphere Application Server 72Db2 66Langflow OSS 59Datastage On Cloud Pak For Data 57Concert 49Financial Transaction Manager (FTM) for RedHat OpenShift 46Financial Transaction Manager 46Verify Identity Access 45Verify Identity Access Container 45Security Verify Access 44Datapower Gateway 43DataPower Gateway 10.6.0 40DataPower Gateway 10.5.0 39DataPower Gateway 10.6CD 39DataPower Gateway 11.0.0 39Security Verify Access Container 38Power System E1180 (9080-heu) Firmware 36Power System E1080 (9080-hex) Firmware 35Power System E1050 (9043-mrx) Firmware 32Power System L1024 (9786-42h) Firmware 32Power System S1122 (9824-22a) Firmware 32Power System E1150 (9043-mru) Firmware 32Power System S1014 (9105-41b) Firmware 32Power System S1114 (9824-41b) Firmware 32Power System L1122 (9856-22h) Firmware 32Power System S1124 (9824-42a) Firmware 32Power System S1122s (9824-22b) Firmware 32Power System L1124 (9856-42h) Firmware 32Power System S1022 (9105-22a) Firmware 32Power System S1024 (9105-42a) Firmware 32Power System S1022s (9105-22b) Firmware 32Power System L1022 (9786-22h) Firmware 32Power System S1012 (9028-21b) Firmware 32WebSphere Application Server - Liberty 29Power System S922 (9009-22g) Firmware 28Power System E980 (9080-m9s) Firmware 28
CVE-2026-95696
Medium · 6.5
CWE-400 Oct 13, 2026
IBM WebSphere Application Server Liberty Denial of Service
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95695
High · 7.4
CWE-863 Oct 13, 2026
IBM WebSphere Application Server Liberty Incorrect Authorization
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-93909
Critical · 9.1
CWE-384 Oct 13, 2026
IBM WebSphere Application Server Liberty is affected by an authentication bypass
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93905
High · 8.2
CWE-502 Oct 13, 2026
IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-93895
Critical · 9.1
CWE-284 Oct 13, 2026
IBM WebSphere Application Server Liberty Improper Access Control
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-79715
Medium · 5.5
CWE-22 Oct 13, 2026
IBM WebSphere Application Server Liberty Path Traversal
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.
CVE-2026-77816
Medium · 6.5
CWE-295 Oct 13, 2026
IBM WebSphere Application Server Liberty Improper Certificate Validation
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
CVE-2026-14909
Medium · 6.5
CWE-209 Oct 13, 2026
IBM WebSphere Application Server Liberty Information Disclosure
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
CVE-2026-14532
Medium · 4.3
CWE-190 Oct 13, 2026
IBM WebSphere Application Server Liberty Integer Overflow
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
CVE-2026-11713
Medium · 5.4
CWE-863 Oct 13, 2026
IBM WebSphere Application Server Liberty Incorrect Authorization
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.
CVE-2026-105443
High · 8.2
CWE-284 Oct 13, 2026
IBM WebSphere Application Server Liberty is affected by an improper access control
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
CVE-2026-105442
High · 7.5
CWE-502 Oct 13, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
CVE-2026-101294
High · 8.7
CWE-325 Oct 13, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
CVE-2026-53711
Medium · 5.1
CWE-79 Oct 13, 2026
MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.
CVE-2026-53709
Critical · 9.8
CWE-287 Oct 13, 2026
MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.
CVE-2026-95680
High · 8.0
CWE-287 Oct 13, 2026
IBM WebSphere Application Server is affected by an authorization bypass
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
CVE-2026-93907
High · 8.1
CWE-287 Oct 13, 2026
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass...
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
CVE-2026-103499
High · 7.5
CWE-400 Oct 13, 2026
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere...
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-96119
Critical · 9.9
CWE-94 Oct 12, 2026
IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
CVE-2026-93886
Medium · 5.4
CWE-79 Oct 12, 2026
IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
CVE-2026-81858
High · 8.1
CWE-125 Oct 12, 2026
IBM i is Affected By A Denial of Service Vulnerability in Host Servers
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
CVE-2026-18343
Medium · 4.4
CWE-269 Oct 12, 2026
IBM i is Affected By An Improper Privilege Management Vulnerability
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.
CVE-2026-18318
Medium · 5.3
CWE-307 Oct 12, 2026
IBM i Information Disclosure
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.
CVE-2026-17487
Medium · 5.3
CWE-200 Oct 12, 2026
IBM i is Information Disclosure
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
CVE-2026-17484
Medium · 5.5
CWE-200 Oct 12, 2026
IBM i is Information Disclosure
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.