Vulnerabilidades de Ibm

CVEs publicadas que afetam produtos de Ibm: 1570 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-8447 Média · 6.1 CWE-79 04/09/2026

Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.

CVE-2026-81859 Média · 6.2 CWE-327 04/09/2026

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm.

CVE-2026-81832 Alta · 7.7 CWE-611 04/09/2026

IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity (XXE) attack.

CVE-2026-9745 Média · 6.5 CWE-283 03/09/2026

Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.

CVE-2026-9744 Média · 5.9 CWE-297 03/09/2026

Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2026-9736 Média · 4.3 CWE-117 03/09/2026

Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

CVE-2026-9036 Média · 5.9 CWE-295 03/09/2026

Vulnerabilities exists in IBM Netezza Software

CVE-2026-8862 Alta · 7.5 CWE-522 03/09/2026

Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information.

CVE-2026-19795 Média · 6.2 CWE-502 03/09/2026

Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input.

CVE-2026-3686 Média · 6.2 CWE-770 28/08/2026

Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources.

CVE-2026-3627 Crítica · 9.1 CWE-89 28/08/2026

Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2026-19295 Crítica · 9.9 CWE-95 28/08/2026

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.

CVE-2026-19294 Média · 6.5 CWE-639 28/08/2026

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

CVE-2026-19286 Crítica · 9.8 CWE-94 28/08/2026

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

CVE-2026-18904 Alta · 8.2 CWE-639 28/08/2026

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

CVE-2026-18899 Alta · 7.5 CWE-22 28/08/2026

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

CVE-2026-18891 Alta · 8.2 CWE-287 28/08/2026

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

CVE-2026-18729 Alta · 8.8 CWE-94 28/08/2026

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

CVE-2026-18545 Média · 4.3 CWE-918 28/08/2026

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2026-18527 Crítica · 9.9 CWE-384 28/08/2026

IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system.

CVE-2026-17203 Alta · 7.5 CWE-287 28/08/2026

IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].

IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

CVE-2026-16821 Alta · 7.8 CWE-134 28/08/2026

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability.

CVE-2025-64649 Média · 5.9 CWE-295 28/08/2026

Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.

CVE-2025-36290 Média · 5.9 CWE-295 28/08/2026

IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2025-36271 Média · 5.9 CWE-759 28/08/2026

IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.