Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,876

Export CSV
CVE-2026-115554

Tivoli Netcool/OMNIbus Web GUI is vulnerable to stored cross-site scripting

IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Tivoli Netcool\/omnibus Tivoli Netcoolomnibus
CVE-2026-78636

IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Liberty
CVE-2026-11547

IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Liberty
CVE-2026-117545

IBM webMethods Integration Server is vulnerable of bypassing the two-factor authentication mechanism.

IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Webmethods Integration Server
CVE-2026-10844

IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Liberty
CVE-2026-101117

IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Extreme Scale
CVE-2025-36075

IBM Safer Payments could allow an authenticated user to obtain sensitive information

IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Safer Payments
CVE-2026-14434

IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by vulnerability

IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Turbonomic Kubeturbo Agent
CVE-2026-93879

Hibernate Validator is affected by an expression language injection vulnerability

Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hibernate Ibm
Products
Hibernate-validator Hibernate Validator
CVE-2026-78537

IBM Guardium Key Lifecycle Manager is affected by a security vulnerability

IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive information due to the use of a weak cryptographic algorithm.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Key Lifecycle Manager
CVE-2026-76052

The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher

IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Storage Scale Storage Scale System
CVE-2026-2700

Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watsonx Orchestrate Cartridge For Cloud Pak For Data
CVE-2026-18668

Protection Mechanism Failure vulnerability affects IBM Sterling File Gateway

IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and  6.2.2.0 - 6.2.2.1_1 could allow a remote attacker to perform protocol downgrade attacks due to a security misconfiguration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Sterling File Gateway
CVE-2026-17426

This Power System update is being released to address

IBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an unhandled exception.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Openbmc
CVE-2026-17401

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17354

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17340

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17335

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-16699

Vulnerability exists in IBM Netezza Appliance

IBM Netezza Appliance 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 could allow a remote authenticated attacker to change the passwords of other users due to improper authorization.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Netezza Appliance
CVE-2026-120115

Multiple vulnerabilities in IBM Aspera Connect

IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aspera Connect