Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,876

Export CSV
CVE-2026-18151

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-2310

IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Webmethods Integration Server
CVE-2026-19646

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Common Licensing
CVE-2026-75777

Multiple vulnerabilities in IBM Aspera Enterprise Webapps

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aspera Enterprise Webapps
CVE-2026-9138

Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with low‑privileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Ibm Langflow and 2 more
Products
Macos Langflow Oss Langflow and 2 more
CVE-2026-9036

Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Netezza Performance Server Netezza Software
CVE-2026-78658

IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an formation disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Ucd Ibm Devops Deploy Ucd Ibm Urbancode Deploy
CVE-2026-19645

Multiple vulnerabilities in IBM MQ Agent images

IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Mq Agent
CVE-2026-19303

Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Apple Ibm Langflow and 2 more
Products
Macos Langflow Oss Langflow and 2 more
CVE-2026-19283

IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Observability With Instana Agent
CVE-2026-18658

IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Operational Decision Manager
CVE-2026-18175

IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-17621

Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Ibm Langflow and 2 more
Products
Macos Langflow Oss Langflow and 2 more
CVE-2026-17444

IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise Integration Bus For Z\/os Integration Bus For Zos
CVE-2026-17273

IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-17270

IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-16941

IBM i is Affected By An Incorrect Authorization Vulnerability []

IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-16660

IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2 Mirror For I
CVE-2026-8862

Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Netezza Performance Server Netezza Software
CVE-2026-9736

Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Netezza Performance Server Netezza Software