Ibm vulnerabilities
Published CVEs affecting Ibm products: 1662 record(s), with severity, exploitation and fixes.
Langflow OSS 176I 163Aix 159Vios 156PowerVM VIOS 145Websphere Application Server 98Guardium Data Protection 91Db2 69Security Verify Access 63Verify Identity Access 63Concert 62Verify Identity Access Container 59Security Verify Access Container 58Datastage On Cloud Pak For Data 58WebSphere Application Server - Liberty 54Financial Transaction Manager (FTM) for RedHat OpenShift 47Financial Transaction Manager 46Datapower Gateway 43DataPower Gateway 10.6.0 43DataPower Gateway 10.5.0 42DataPower Gateway 11.0.0 41DataPower Gateway 10.6CD 41Power System E1180 (9080-heu) Firmware 36Power System E1080 (9080-hex) Firmware 35Power System L1124 (9856-42h) Firmware 32Power System E1150 (9043-mru) Firmware 32Power System S1024 (9105-42a) Firmware 32Power System S1022 (9105-22a) Firmware 32Power System S1022s (9105-22b) Firmware 32Power System E1050 (9043-mrx) Firmware 32Power System S1114 (9824-41b) Firmware 32Power System L1122 (9856-22h) Firmware 32Power System S1014 (9105-41b) Firmware 32Power System L1024 (9786-42h) Firmware 32Power System S1012 (9028-21b) Firmware 32Power System L1022 (9786-22h) Firmware 32Power System S1122 (9824-22a) Firmware 32Power System S1124 (9824-42a) Firmware 32Power System S1122s (9824-22b) Firmware 32Power System S922 (9009-22g) Firmware 28
CVE-2023-38281
Medium · 5.3
CWE-209 Feb 4, 2026
Multiple Vulnerabilities in IBM Cloud Pak System
IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVE-2023-38017
Medium · 5.3
CWE-209 Feb 4, 2026
Multiple Vulnerabilities in IBM Cloud Pak System
IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2023-38010
High · 7.5
CWE-209 Feb 4, 2026
Multiple Vulnerabilities in IBM Cloud Pak System
IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system.
CVE-2025-36094
High · 8.1
CWE-1284 Feb 3, 2026
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.
IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 could allow an authenticated user to cause a denial of service or corrupt existing data due to the improper validation of input length.
CVE-2025-36033
Medium · 5.4
CWE-79 Feb 3, 2026
IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting
IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-33081
Medium · 5.5
CWE-312 Feb 3, 2026
Multiple Vulnerabilities in IBM Concert Software.
IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user.
CVE-2025-36436
Medium · 5.4
CWE-79 Feb 2, 2026
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.
IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-36253
High · 7.5
CWE-759 Feb 2, 2026
Multiple Vulnerabilities in IBM Concert Software.
IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2025-36238
Medium · 6.0
CWE-497 Feb 2, 2026
Power System Exposure of Sensitive System Information
IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.
CVE-2025-36194
Low · 3.3
CWE-1262 Feb 2, 2026
This Power System update is being released to address
IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer partition in specific shared processor configurations during certain operations.
CVE-2025-13096
High · 7.1
CWE-918 Feb 2, 2026
XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -
IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVE-2025-15395
Medium · 5.4
CWE-863 Feb 2, 2026
IBM Jazz Foundation access control violation
IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violations that allows the users to view or access/perform actions beyond their expected capability.
CVE-2025-14914
High · 7.6
CWE-22 Feb 2, 2026
IBM WebSphere Application Server Liberty Path Traversal
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.
CVE-2025-36442
High · 7.5
CWE-943 Jan 30, 2026
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns.
CVE-2025-36428
Medium · 5.3
CWE-1284 Jan 30, 2026
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when the RPSCAN feature is enabled.
CVE-2025-36427
Medium · 6.5
CWE-1284 Jan 30, 2026
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special elements in data query logic.
CVE-2025-36424
Medium · 6.5
CWE-1284 Jan 30, 2026
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query logic.
CVE-2025-36423
Medium · 5.5
CWE-1284 Jan 30, 2026
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.
CVE-2025-36407
Medium · 5.5
CWE-1284 Jan 30, 2026
IBM Db2 Denial of Service
IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.
CVE-2025-36387
Medium · 6.5
CWE-770 Jan 30, 2026
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query.
CVE-2025-36384
High · 7.8
CWE-428 Jan 30, 2026
IBM Db2 Privilege Escalation
IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element.
CVE-2025-36366
Medium · 6.5
CWE-943 Jan 30, 2026
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination.
CVE-2025-36365
High · 7.5
CWE-639 Jan 30, 2026
IBM Db2 Privilege Escalation
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.
CVE-2025-36353
Medium · 5.5
CWE-943 Jan 30, 2026
IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.
CVE-2025-36184
High · 7.2
CWE-250 Jan 30, 2026
IBM Db2 Privilege Escalation
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.