Vulnerabilidades de Ibm

CVEs publicadas que afetam produtos de Ibm: 1567 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-13260 Alta · 7.5 CWE-770 14/09/2026

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.

CVE-2026-13107 Alta · 7.1 CWE-611 14/09/2026

Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.

CVE-2026-12767 Média · 6.5 CWE-918 14/09/2026

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2026-12766 Média · 5.4 CWE-918 14/09/2026

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2026-12765 Média · 6.5 CWE-918 14/09/2026

Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2026-12763 Média · 4.2 CWE-306 14/09/2026

Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

CVE-2026-18251 Média · 4.3 CWE-1385 14/09/2026

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.

CVE-2026-18065 Média · 5.3 CWE-290 14/09/2026

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.

CVE-2026-17628 Média · 5.4 CWE-287 14/09/2026

Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.

CVE-2026-17467 Alta · 8.2 CWE-327 14/09/2026

Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols.

CVE-2026-17463 Média · 6.5 CWE-400 14/09/2026

IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.

CVE-2026-17416 Alta · 7.8 CWE-502 14/09/2026

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.

CVE-2026-17156 Alta · 7.8 CWE-502 14/09/2026

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.

CVE-2026-17133 Alta · 7.8 CWE-78 14/09/2026

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVE-2026-17047 Média · 5.4 CWE-352 14/09/2026

IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.

CVE-2026-16702 Média · 6.5 CWE-476 14/09/2026

IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference

CVE-2026-16673 Alta · 8.8 CWE-78 14/09/2026

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.

CVE-2026-16435 Média · 5.9 CWE-650 14/09/2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.

CVE-2026-16190 Baixa · 3.1 CWE-862 14/09/2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.

CVE-2026-16189 Média · 4.8 CWE-117 14/09/2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

CVE-2026-16466 Alta · 8.8 CWE-78 14/09/2026

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.

CVE-2026-16432 Média · 6.5 CWE-611 14/09/2026

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

CVE-2026-16428 Alta · 8.8 CWE-94 14/09/2026

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

CVE-2026-16338 Alta · 8.8 CWE-73 14/09/2026

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.

CVE-2026-16335 Alta · 8.8 CWE-22 14/09/2026

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability.