IBM
Page 7 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36428 | Medium | 5.3 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36427 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special ele… |
CVE-2025-36424 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special ele… |
CVE-2025-36423 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutral… |
CVE-2025-36407 | Medium | 6.5 | 2026-01-30 | IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. |
CVE-2025-36387 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given spe… |
CVE-2025-36384 | High | 8.4 | 2026-01-30 | IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path ele… |
CVE-2025-36366 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Ob… |
CVE-2025-36365 | Medium | 6.8 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage… |
CVE-2025-36353 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due… |
CVE-2025-36184 | High | 7.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their p… |
CVE-2025-36123 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service whe… |
CVE-2025-36098 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36070 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur… |
CVE-2025-36009 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a glob… |
CVE-2025-36001 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-2668 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenti… |
CVE-2025-36419 | Medium | 5.3 | 2026-01-20 | IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system. |
CVE-2025-36418 | High | 7.3 | 2026-01-20 | IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modi… |
CVE-2025-36411 | Low | 3.5 | 2026-01-20 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2025-36410 | Low | 3.1 | 2026-01-20 | IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side s… |
CVE-2025-36409 | Medium | 5.4 | 2026-01-20 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2025-36408 | Medium | 6.4 | 2026-01-20 | IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI… |
CVE-2025-36397 | Medium | 5.4 | 2026-01-20 | IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be ex… |
CVE-2025-36396 | Medium | 5.4 | 2026-01-20 | IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScrip… |
CVE-2025-36115 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0.00 through 5.2.0.12 does not disallow the session id after use which could allow an auth… |
CVE-2025-36113 | Medium | 5.4 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2025-36066 | Medium | 6.1 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2025-36065 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a browser closure which coul… |
CVE-2025-36063 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a logout which could allow a… |
CVE-2025-36059 | Medium | 4.7 | 2026-01-20 | IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix… |
CVE-2025-36058 | Medium | 5.5 | 2026-01-20 | IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix… |
CVE-2025-33015 | High | 8.8 | 2026-01-20 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. |
CVE-2025-1722 | Medium | 5.9 | 2026-01-20 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
CVE-2025-1719 | Medium | 5.9 | 2026-01-20 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
CVE-2025-14115 | High | 8.4 | 2026-01-20 | IBM Sterling Connect:Direct for UNIX Container 6.3.0.0 through 6.3.0.6 Interim Fix 016, and 6.4.0.0 through 6.4.0.3 Interim Fix 019 IBM® Sterling Connect:Direc… |
CVE-2025-13925 | Medium | 4.9 | 2026-01-20 | IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user. |
CVE-2025-12985 | High | 8.4 | 2026-01-20 | IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM L… |
CVE-2026-0992 | Low | 2.9 | 2026-01-15 | A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCa… |
CVE-2026-0990 | Medium | 5.9 | 2026-01-15 | A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catal… |
CVE-2026-0989 | Low | 3.7 | 2026-01-15 | A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion… |
CVE-2025-64645 | High | 7.7 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a symbolic link. |
CVE-2025-36230 | Medium | 5.4 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be exe… |
CVE-2025-36229 | Low | 3.1 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers. |
CVE-2025-36228 | Low | 3.8 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that… |
CVE-2025-36192 | Medium | 6.7 | 2025-12-26 | IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could… |
CVE-2025-14687 | Medium | 4.3 | 2025-12-26 | IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side… |
CVE-2025-13915 | Critical | 9.8 | 2025-12-26 | IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the… |
CVE-2025-1721 | Medium | 5.9 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
CVE-2025-12771 | High | 7.8 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and… |
CVE-2025-36154 | Medium | 6.2 | 2025-12-24 | IBM Concert 1.0.0 through 2.1.0 stores sensitive information in cleartext during recursive docker builds which could be obtained by a local user. |
CVE-2025-36360 | Medium | 5.0 | 2025-12-15 | IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8… |
CVE-2025-14148 | Medium | 6.5 | 2025-12-15 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved L… |
CVE-2025-13489 | Medium | 5.9 | 2025-12-15 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensitive information usi… |
CVE-2025-13481 | High | 8.8 | 2025-12-11 | IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to impro… |
CVE-2025-13214 | High | 7.6 | 2025-12-11 | IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow th… |
CVE-2025-13211 | Medium | 5.3 | 2025-12-11 | IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of inte… |
CVE-2025-13148 | High | 8.1 | 2025-12-11 | IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that pass… |
CVE-2025-36437 | Medium | 4.3 | 2025-12-09 | IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system. |
CVE-2024-56464 | Low | 2.7 | 2025-12-09 | IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed thi… |
CVE-2025-36140 | Medium | 6.5 | 2025-12-08 | IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resource… |
CVE-2025-64650 | Medium | 6.5 | 2025-12-08 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files. |
CVE-2025-36102 | Low | 2.7 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input… |
CVE-2025-36017 | Medium | 6.5 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables fi… |
CVE-2025-36015 | Medium | 6.5 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to… |
CVE-2025-33111 | Medium | 4.3 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations… |
CVE-2025-12832 | Medium | 4.6 | 2025-12-08 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to se… |
CVE-2025-12635 | Medium | 5.4 | 2025-12-08 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to i… |
CVE-2024-45675 | High | 8.4 | 2025-12-02 | IBM Informix Dynamic Server 14.10 could allow a local user on the system to log into the Informix server as administrator without a password. |
CVE-2025-36134 | Low | 3.7 | 2025-11-25 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information… |
CVE-2025-36150 | Medium | 5.9 | 2025-11-24 | IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2025-36112 | Medium | 5.3 | 2025-11-24 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could reveal sensitive server IP conf… |
CVE-2025-36149 | Medium | 6.3 | 2025-11-21 | IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. |
CVE-2025-36072 | High | 8.8 | 2025-11-20 | IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an… |
CVE-2025-36160 | Medium | 5.3 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system. |
CVE-2025-36159 | Medium | 6.2 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of… |
CVE-2025-36158 | Medium | 5.1 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontrolled recursive dire… |
CVE-2025-36153 | Medium | 6.1 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code… |
CVE-2025-36161 | Medium | 5.9 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-S… |
CVE-2025-36371 | Medium | 6.5 | 2025-11-19 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. A user with access to the… |
CVE-2025-36118 | High | 7.5 | 2025-11-17 | IBM Storage Virtualize 8.4, 8.5, 8.7, and 9.1 IKEv1 implementation allows remote attackers to obtain sensitive information from device memory via a Security As… |
CVE-2025-36357 | High | 8.0 | 2025-11-17 | IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a speci… |
CVE-2025-36299 | Medium | 4.3 | 2025-11-17 | IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system. |
CVE-2025-36251 | Critical | 9.6 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to imprope… |
CVE-2025-36250 | Critical | 10.0 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary c… |
CVE-2025-36236 | High | 8.2 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directorie… |
CVE-2025-36096 | Critical | 9.0 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access… |
CVE-2025-33119 | Medium | 6.5 | 2025-11-12 | IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user. |
CVE-2025-36223 | Medium | 5.4 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to c… |
CVE-2025-27368 | Medium | 4.3 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points u… |
CVE-2025-33150 | Medium | 5.3 | 2025-11-10 | IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages. |
CVE-2025-36186 | High | 7.4 | 2025-11-07 | IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malic… |
CVE-2025-36185 | Medium | 6.2 | 2025-11-07 | IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper n… |
CVE-2025-36136 | Medium | 5.1 | 2025-11-07 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial o… |
CVE-2025-36135 | Medium | 5.4 | 2025-11-07 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 th… |
CVE-2025-36131 | Medium | 4.6 | 2025-11-07 | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exp… |
CVE-2025-36008 | Medium | 6.5 | 2025-11-07 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-36006 | Medium | 6.5 | 2025-11-07 | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Ser… |
CVE-2025-33012 | Medium | 6.3 | 2025-11-07 | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain… |
CVE-2025-2534 | Medium | 5.3 | 2025-11-07 | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a… |