IBM
Page 3 of 93 — IBM CVEs from a corpus of 9245, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12728 | High | 8.8 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12667 | High | 7.1 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12666 | High | 8.1 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12358 | High | 7.5 | 2026-09-15 | IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. |
CVE-2026-12355 | High | 8.1 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12354 | High | 7.5 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12351 | Critical | 9.8 | 2026-09-15 | IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote a… |
CVE-2026-12150 | High | 7.0 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12101 | High | 8.1 | 2026-09-15 | IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied req… |
CVE-2026-11934 | High | 7.2 | 2026-09-15 | IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied inp… |
CVE-2026-11929 | High | 7.5 | 2026-09-15 | IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data. |
CVE-2026-11928 | Critical | 9.8 | 2026-09-15 | IBM Verify Identity Access is vulnerable to a buffer overflow attack. |
CVE-2026-11927 | Medium | 6.5 | 2026-09-15 | IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services. |
CVE-2026-11926 | High | 7.5 | 2026-09-15 | IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. |
CVE-2026-11921 | Critical | 9.1 | 2026-09-15 | IBM Verify Identity Access containers may not apply management password change operations correctly. |
CVE-2026-11918 | Medium | 5.4 | 2026-09-15 | IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive insp… |
CVE-2026-11864 | Medium | 6.5 | 2026-09-15 | IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and… |
CVE-2026-11729 | High | 8.5 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-11728 | High | 8.1 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-53710 | Critical | 10.0 | 2026-09-15 | MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/pyth… |
CVE-2026-13265 | Medium | 6.8 | 2026-09-14 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12944 | Critical | 9.6 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting co… |
CVE-2026-12759 | Medium | 6.5 | 2026-09-14 | IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-12758 | Medium | 5.4 | 2026-09-14 | IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP… |
CVE-2026-12756 | High | 7.1 | 2026-09-14 | IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote a… |
CVE-2026-7884 | Medium | 5.4 | 2026-09-14 | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include mali… |
CVE-2026-78415 | Medium | 5.4 | 2026-09-14 | IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutr… |
CVE-2026-75792 | Medium | 4.3 | 2026-09-14 | IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-si… |
CVE-2026-19290 | High | 7.5 | 2026-09-14 | IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 could allow a remote attacker to obtain sensitive information due to… |
CVE-2026-19280 | Medium | 5.2 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this… |
CVE-2026-19273 | Medium | 5.4 | 2026-09-14 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 -… |
CVE-2026-19086 | Low | 3.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this… |
CVE-2026-18069 | Medium | 6.0 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) r… |
CVE-2026-14277 | Medium | 6.3 | 2026-09-14 | IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to i… |
CVE-2026-14276 | Medium | 6.3 | 2026-09-14 | IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user pri… |
CVE-2026-14275 | Medium | 6.3 | 2026-09-14 | IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user pri… |
CVE-2026-13293 | High | 8.8 | 2026-09-14 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-13287 | High | 7.1 | 2026-09-14 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-13285 | High | 7.1 | 2026-09-14 | IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose se… |
CVE-2026-13277 | Medium | 4.7 | 2026-09-14 | IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a speciall… |
CVE-2026-13276 | Medium | 6.1 | 2026-09-14 | IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity… |
CVE-2026-13275 | High | 7.1 | 2026-09-14 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-13272 | Medium | 5.4 | 2026-09-14 | IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further… |
CVE-2026-13260 | High | 7.5 | 2026-09-14 | IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. |
CVE-2026-13107 | High | 7.1 | 2026-09-14 | IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default. |
CVE-2026-12767 | Medium | 6.5 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requ… |
CVE-2026-12766 | Medium | 5.4 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reques… |
CVE-2026-12765 | Medium | 6.5 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requ… |
CVE-2026-12763 | Medium | 4.2 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in… |
CVE-2026-18251 | Medium | 4.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin. |
CVE-2026-18065 | Medium | 5.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigat… |
CVE-2026-17628 | Medium | 5.4 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication. |
CVE-2026-17467 | High | 8.2 | 2026-09-14 | IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptog… |
CVE-2026-17463 | Medium | 6.5 | 2026-09-14 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker… |
CVE-2026-17416 | High | 7.8 | 2026-09-14 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure de… |
CVE-2026-17156 | High | 7.8 | 2026-09-14 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure de… |
CVE-2026-17133 | High | 7.8 | 2026-09-14 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper ne… |
CVE-2026-17047 | Medium | 5.4 | 2026-09-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation. |
CVE-2026-16702 | Medium | 6.5 | 2026-09-14 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker… |
CVE-2026-16673 | High | 8.8 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutrali… |
CVE-2026-16466 | High | 8.8 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection. |
CVE-2026-16435 | Medium | 5.9 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features. |
CVE-2026-16432 | High | 7.7 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due t… |
CVE-2026-16428 | High | 8.8 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration o… |
CVE-2026-16338 | Critical | 9.9 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper valida… |
CVE-2026-16335 | High | 8.1 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path t… |
CVE-2026-16190 | Low | 3.1 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability. |
CVE-2026-16189 | Medium | 4.8 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. |
CVE-2026-16188 | Medium | 5.3 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. |
CVE-2026-16187 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unau… |
CVE-2026-16186 | Medium | 5.4 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability. |
CVE-2026-16185 | Medium | 6.4 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet. |
CVE-2026-15955 | High | 7.5 | 2026-09-14 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file pa… |
CVE-2026-15887 | Medium | 5.4 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests. |
CVE-2026-15634 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsi… |
CVE-2026-15412 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using a… |
CVE-2026-15396 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsi… |
CVE-2026-19543 | Medium | 6.2 | 2026-09-14 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side an… |
CVE-2026-18515 | Medium | 4.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked b… |
CVE-2026-18151 | Medium | 4.2 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake… |
CVE-2026-53708 | Medium | 6.6 | 2026-09-14 | ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior t… |
CVE-2026-87958 | High | 8.1 | 2026-09-10 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by… |
CVE-2026-86093 | High | 7.5 | 2026-09-10 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute a… |
CVE-2026-86087 | Medium | 4.3 | 2026-09-10 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the… |
CVE-2026-84889 | High | 8.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restr… |
CVE-2026-82107 | Critical | 9.6 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to… |
CVE-2026-82100 | Critical | 9.6 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. |
CVE-2026-82099 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
CVE-2026-82098 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
CVE-2026-82097 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) v… |
CVE-2026-82095 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
CVE-2026-82092 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulne… |
CVE-2026-81941 | High | 8.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the pr… |
CVE-2026-81940 | High | 8.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special character… |
CVE-2026-81554 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulne… |
CVE-2026-81551 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path… |
CVE-2026-81550 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
CVE-2026-81540 | High | 8.5 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path tra… |
CVE-2026-81268 | High | 8.1 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session… |
CVE-2026-81265 | High | 7.5 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5. |