Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,876

Export CSV
CVE-2025-3633

IBM Cognos Analytics is affected by multiple security vulnerabilities

IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vulnerability allows a remote attacker to inject arbitrary JavaScript code into the web user interface, which may alter the intended functionality and could lead to the disclosure of credentials within a trusted session.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cognos Analytics Cognos Transformer
CVE-2026-1718

IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are enabled.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Db2 Linux On Ibm Z Linux Kernel
CVE-2026-3366

InfoSphere Optim Test Data Fabrication is affected by Arbitrary File Read

IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.2.2, 1.0.2.3, 1.0.2.4, 1.0.2.5, 1.0.2.6, 1.0.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Infosphere Optim Test Data Fabrication
CVE-2026-3623

Vulnerabilities exists in IBM Netezza Performance Server Replication Services

IBM Netezza Performance Server Replication Services 3.0.2.0 through 3.0.5.0 allows an attacker with low‑privileged access to escalate their privileges to root. By exploiting this flaw, the attacker can execute root‑level commands, obtain a root shell, and change the root user’s password. Successful exploitation also enables modification or removal of system‑wide files and the installation of persistent backdoors. This results in full system compromise with complete loss of confidentiality, integrity, and availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Netezza Performance Server Replication Services
CVE-2026-3676

There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.

IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4 IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of the Fenced environment.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Apm Advanced Private Cloud Apm Base Private Cloud Application Performance Managemen
CVE-2026-3603

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through  Interim Fix 021, 7.1.0  Interim Fix 001 through  Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Engineering Lifecycle Management
CVE-2026-8620

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Web Server Plug-ins For Websphere Application Server And Websphere Liberty Web Server Plug Ins For Websphere Application Server And Websphere Liberty Websphere Application Server
CVE-2026-5515

IBM App Connect Enterprise is vulnerable to a confidential disclosure

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise
CVE-2026-5516

IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability

IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing window.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-7254

Open BMC Denial of Service

IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Openbmc
CVE-2026-7365

IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installation

IBM Operations Analytics - Log Analysis  and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Operations Analytics - Log Analysis Operations Analytics Log Analysis Operations Analytics Log Analysis
CVE-2026-7524

Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm Langflow
Products
Langflow Oss Langflow
CVE-2026-7528

Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS

IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm Langflow
Products
Langflow Oss Langflow
CVE-2026-5065

IBM Controller is affected by vulnerabilities

IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Controller
CVE-2025-36220

Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.

IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak For Data System - Cyclops Cloud Pak For Data System Cyclops
CVE-2025-36221

Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.

IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak For Data System - Cyclops Cloud Pak For Data System Cyclops
CVE-2025-8732

libxml2 xmlcatalog xmlParseSGMLCatalog recursion

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Ibm Siemens and 1 more
Products
Libxml2 Aix Vios and 3 more
CVE-2025-14290

IBM webMethods Integration Sever is vulnerable to server-side request forgery

IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Webmethods Integration On Prem Integration Server Webmethods Integration On Prem Integration Server Webmethods Integration Server
CVE-2025-36126

IBM Cognos Analytics is affected by Cross-site scripting.

IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cognos Analytics Cognos Transformer
CVE-2025-36145

Multiple Vulnerabilities in watsonx.data

IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modify files without restrictions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watsonx.data Watsonxdata