Vulnerabilidades de Ibm

CVEs publicadas que afetam produtos de Ibm: 1629 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-9198 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 17/07/2026

IBM Langflow Code Injection Vulnerability

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

CVE-2026-9074 Crítica · 9.8 CWE-89 08/07/2026

IBM API Connect SQL Injection

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

CVE-2026-3144 Crítica · 9.8 CWE-1392 08/07/2026

IBM API Connect Default Credentials

IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

CVE-2026-11541 Crítica · 9.8 CWE-444 30/06/2026

Contrabando de requisições HTTP (HTTP Request Smuggling) no IBM WebSphere Application Server e Liberty (CVE-2026-11541)

IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3 e 10.1, IBM WebSphere Application Server 9.0 e 8.5 e IBM WebSphere Application Server - Liberty 17.0.0.3 até 26.0.0.6 são afetados por uma vulnerabilidade de contrabando de requisições HTTP (HTTP request smuggling).

CVE-2026-11594 Média · 6.1 CWE-79 30/06/2026

IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.

CVE-2025-36336 Média · 5.9 CWE-319 30/06/2026

Cleartext Transmission of Sensitive Information in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2025-36359 Média · 6.5 CWE-613 30/06/2026

IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

CVE-2025-36333 Média · 4.3 CWE-841 30/06/2026

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perform unauthorized actions due to the improper enforcement of behavioral workflow.

CVE-2025-36328 Média · 4.3 CWE-209 30/06/2026

Error Message Containing Sensitive Information found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVE-2025-36327 Média · 6.5 CWE-602 30/06/2026

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to client-side enforcement of sever-side security.

CVE-2025-36324 Média · 4.3 CWE-918 30/06/2026

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2025-36323 Média · 5.4 CWE-79 30/06/2026

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-36321 Média · 5.7 CWE-80 30/06/2026

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

CVE-2025-36320 Média · 6.4 CWE-79 30/06/2026

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-36319 Média · 4.3 CWE-770 30/06/2026

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to cause a temporary denial using a specially crafted HTTP request due to improper allocation of resource throttling.

CVE-2025-12530 Média · 5.9 CWE-319 30/06/2026

Vulnerabilities found in Watson Data Intelligence

IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2026-9836 Alta · 7.5 CWE-200 30/06/2026

IBM DataStage Flow Designer application is affected by an information disclosure vulnerability

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability.

CVE-2026-9002 Média · 6.5 CWE-400 30/06/2026

IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to improper validation in the XDF decoder. The application processes deeply nested Protocol Buffers messages and attacker-controlled length prefixes without sufficient bounds checking, which may allow an attacker on the same network to trigger a StackOverflowError or OutOfMemoryError, resulting in a crash of the WebSphere Application Server JVM.

CVE-2026-7874 Crítica · 9.1 CWE-338 30/06/2026

IBM Langflow OSS: derivação de chave fraca e reversível expõe credenciais armazenadas

IBM Langflow OSS 1.0.0 até 1.10.0 Langflow pode permitir a divulgação de todas as credenciais armazenadas devido ao uso de um mecanismo de derivação de chave fraco e reversível para criptografia em repouso.

CVE-2026-7873 Crítica · 9.9 Exploit público CWE-94 30/06/2026

IBM Langflow OSS: Injeção de Código com Execução de Comandos no Sistema Operacional

O IBM Langflow OSS 1.0.0 até 1.10.0 permite que atacantes autenticados executem comandos arbitrários no sistema operacional e leiam arquivos sensíveis, incluindo credenciais, possibilitando o comprometimento completo do sistema e movimentação lateral.

CVE-2026-7871 Crítica · 9.8 CWE-502 30/06/2026

Falha de desserialização no IBM Langflow OSS permite execução de código via acesso ao Redis

O IBM Langflow OSS 1.0.0 até 1.10.0 permite que usuários com acesso ao Redis executem código arbitrário com privilégios completos da aplicação, comprometendo todos os segredos, dados e a integridade do sistema.

CVE-2026-7803 Crítica · 9.8 CWE-20 30/06/2026

IBM Langflow OSS: Validação Inadequada de Entrada Leva à Execução Arbitrária de Código

IBM Langflow OSS 1.0.0 até 1.10.0 pode permitir execução arbitrária de código devido à validação inadequada de nós de fluxo com campos de tipo de componente ausentes ou vazios.

CVE-2026-7663 Crítica · 9.8 CWE-863 30/06/2026

IBM Langflow OSS: Autorização Incorreta no Endpoint de Transporte MCP

A IBM Langflow OSS 1.0.0 até 1.9.6 pode permitir que atacantes não autenticados acessem recursos de projetos MCP protegidos e executem operações MCP devido à aplicação inadequada de autorização no endpoint de transporte Streamable MCP.

CVE-2026-3602 Média · 5.5 CWE-89 30/06/2026

IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.

CVE-2026-13773 Crítica · 10.0 CWE-918 30/06/2026

SSRF via Desserialização Java no IBM WebSphere eXtreme Scale (CVE-2026-13773)

IBM WebSphere Extreme Scale 8.6.1.0 até 8.6.1.6 Aproximadamente 50 classes stub CORBA geradas no ogclient.jar do WebSphere eXtreme Scale chamam ORB.string_to_object() em uma string IOR controlada pelo atacante durante a desserialização Java, transformando qualquer sink ObjectInputStream não filtrado no WAS em SSRF IIOP de saída para um host escolhido pelo atacante; quando encadeado com a falha de instanciação de classe em getUserException do ORB IBM (WAS-26), esse SSRF escala para execução remota de código na JVM chamadora.