Vulnerabilidades de Ibm

CVEs publicadas que afetam produtos de Ibm: 785 registro(s), com severidade, exploração e correções.

Guardium Data Protection 79 Db2 54 Financial Transaction Manager (FTM) for RedHat OpenShift 46 Financial Transaction Manager 46 Langflow OSS 42 Datapower Gateway 41 DataPower Gateway 10.6.0 40 Websphere Application Server 39 DataPower Gateway 11.0.0 39 DataPower Gateway 10.5.0 39 DataPower Gateway 10.6CD 39 Concert 37 Datastage On Cloud Pak For Data 34 Security Verify Access 33 Security Verify Access Container 33 Verify Identity Access 33 Verify Identity Access Container 33 WebSphere Application Server - Liberty 29 Db2 for Linux, UNIX and Windows 22 Infosphere Information Server 21 I 16 Sterling B2b Integrator 14 Sterling File Gateway 13 Qradar Security Information And Event Manager 12 Aix 11 Watsonx.data Intelligence 11 Vios 10 Planning Analytics 9 Aspera Faspex 8 Langflow Desktop 8 Controller 8 Http Server 8 Powervm Hypervisor 8 IBM QRadar SIEM 7 Db2 Recovery Expert 7 Cloud Pak For Business Automation 6 UCD - IBM DevOps Deploy 6 DB2 Recovery Expert for LUW 6 Watsonx.data 6 Aspera Orchestrator 6

Somente exploradas (KEV) →

CVE-2026-95696 Média · 6.5 CWE-400 13/10/2026

IBM WebSphere Application Server Liberty Denial of Service

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.

CVE-2026-95695 Alta · 7.4 CWE-863 13/10/2026

IBM WebSphere Application Server Liberty Incorrect Authorization

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

CVE-2026-93909 Crítica · 9.1 CWE-384 13/10/2026

IBM WebSphere Application Server Liberty is affected by an authentication bypass

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

CVE-2026-93905 Alta · 8.2 CWE-502 13/10/2026

IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

CVE-2026-93895 Crítica · 9.1 CWE-284 13/10/2026

IBM WebSphere Application Server Liberty Improper Access Control

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

CVE-2026-79715 Média · 5.5 CWE-22 13/10/2026

IBM WebSphere Application Server Liberty Path Traversal

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.

CVE-2026-77816 Média · 6.5 CWE-295 13/10/2026

IBM WebSphere Application Server Liberty Improper Certificate Validation

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.

CVE-2026-14909 Média · 6.5 CWE-209 13/10/2026

IBM WebSphere Application Server Liberty Information Disclosure

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.

CVE-2026-14532 Média · 4.3 CWE-190 13/10/2026

IBM WebSphere Application Server Liberty Integer Overflow

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.

CVE-2026-11713 Média · 5.4 CWE-863 13/10/2026

IBM WebSphere Application Server Liberty Incorrect Authorization

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.

CVE-2026-105443 Alta · 8.2 CWE-284 13/10/2026

IBM WebSphere Application Server Liberty is affected by an improper access control

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.

CVE-2026-105442 Alta · 7.5 CWE-502 13/10/2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.

CVE-2026-101294 Alta · 8.7 CWE-325 13/10/2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.

CVE-2026-53711 Média · 5.1 CWE-79 13/10/2026

MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI

MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.

CVE-2026-53709 Crítica · 9.8 CWE-287 13/10/2026

MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.

CVE-2026-95680 Alta · 8.0 CWE-287 13/10/2026

IBM WebSphere Application Server is affected by an authorization bypass

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

CVE-2026-93907 Alta · 8.1 CWE-287 13/10/2026

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass...

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

CVE-2026-103499 Alta · 7.5 CWE-400 13/10/2026

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere...

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.

CVE-2026-96119 Crítica · 9.9 CWE-94 12/10/2026

Injeção de código no GUI de administração do HTTP Server do IBM i

O IBM i 7.3, 7.4, 7.5 e 7.6 pode permitir que um atacante remoto autenticado obtenha informações sensíveis ou execute código arbitrário no sistema devido à sanitização imprópria de dados pela aplicação web HTTP Server Administration.

CVE-2026-93886 Média · 5.4 CWE-79 12/10/2026

IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

CVE-2026-81858 Alta · 8.1 CWE-125 12/10/2026

IBM i is Affected By A Denial of Service Vulnerability in Host Servers

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

CVE-2026-18343 Média · 4.4 CWE-269 12/10/2026

IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

CVE-2026-18318 Média · 5.3 CWE-307 12/10/2026

IBM i Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

CVE-2026-17487 Média · 5.3 CWE-200 12/10/2026

IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

CVE-2026-17484 Média · 5.5 CWE-200 12/10/2026

IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.