Ibm vulnerabilities

Published CVEs affecting Ibm products: 1567 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-93907 High · 8.1 CWE-287 Oct 13, 2026

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass...

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

CVE-2026-103499 High · 7.5 CWE-400 Oct 13, 2026

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere...

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.

CVE-2026-96119 Critical · 9.9 CWE-94 Oct 12, 2026

IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

CVE-2026-93886 Medium · 5.4 CWE-79 Oct 12, 2026

IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

CVE-2026-81858 High · 8.1 CWE-125 Oct 12, 2026

IBM i is Affected By A Denial of Service Vulnerability in Host Servers

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

CVE-2026-18343 Medium · 4.4 CWE-269 Oct 12, 2026

IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

CVE-2026-18318 Medium · 5.3 CWE-307 Oct 12, 2026

IBM i Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

CVE-2026-17487 Medium · 5.3 CWE-200 Oct 12, 2026

IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

CVE-2026-17484 Medium · 5.5 CWE-200 Oct 12, 2026

IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

CVE-2026-93892 High · 8.1 CWE-200 Oct 12, 2026

Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.

CVE-2026-93891 High · 7.6 CWE-611 Oct 12, 2026

Security Vulnerability identified in IBM TRIRIGA - XXE

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

CVE-2026-92832 Medium · 5.1 CWE-319 Oct 12, 2026

IBM Aspera Enterprise Webapps Information Disclosure

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.

CVE-2026-85457 High · 8.1 CWE-121 Oct 12, 2026

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

CVE-2026-84418 High · 7.4 CWE-295 Oct 12, 2026

DataStage on Cloud Pak for Data Improper Certificate Validation

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.

CVE-2026-82110 Critical · 9.9 CWE-22 Oct 12, 2026

DataStage on Cloud Pak for Data Path Traversal

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

CVE-2026-82108 High · 8.8 CWE-94 Oct 12, 2026

DataStage on Cloud Pak for Data Code Injection

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVE-2026-82103 Medium · 6.5 CWE-200 Oct 12, 2026

DataStage on Cloud Pak for Data Information Disclosure

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.

CVE-2026-82101 Critical · 9.6 CWE-22 Oct 12, 2026

IBM DataStage on Cloud Pak for Data path traversal denial of service

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

CVE-2026-82096 High · 8.8 CWE-78 Oct 12, 2026

DataStage on Cloud Pak for Data Command Injection

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVE-2026-75782 High · 7.8 CWE-426 Oct 12, 2026

IBM Aspera Enterprise Webapps Untrusted Search Path

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.

CVE-2026-75621 Medium · 6.2 CWE-250 Oct 12, 2026

IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.

CVE-2026-75095 High · 7.5 CWE-400 Oct 12, 2026

IBM Aspera Enterprise Webapps Denial of Service

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

CVE-2026-75076 Medium · 4.3 CWE-200 Oct 12, 2026

IBM Aspera Enterprise Webapps Information Disclosure

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.

CVE-2026-75063 Medium · 5.4 CWE-79 Oct 12, 2026

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.

CVE-2026-75061 High · 7.5 CWE-22 Oct 12, 2026

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.