Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,876

Export CSV
CVE-2026-17299

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17301

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17302

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network services due to improper validation of a user-supplied URL.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17305

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17306

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from internal network resources due to server-side request forgery.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-16325

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-16427

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-16433

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-18093

IBM App Connect Enterprise is vulnerable to a credential exposure

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise
CVE-2026-18194

IBM App Connect Enterprise is vulnerable to a clickjacking attack

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise
CVE-2026-18195

IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise
CVE-2026-18196

IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise
CVE-2026-97677

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process — including configuration files, secrets, or database files stored under the application's data directory.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm Langflow
Products
Langflow Oss Langflow
CVE-2026-17402

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.

CVSS 3.1 · 9.9 Critical EPSS 1.9% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17172

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-84229

IBM Guardium Data Protection is affected by multiple vulnerabilities

IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Data Protection
CVE-2026-84228

IBM Guardium Data Protection is affected by multiple vulnerabilities

IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Data Protection
CVE-2026-84030

IBM Guardium Data Protection is affected by multiple vulnerabilities

IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Data Protection
CVE-2026-81542

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-80435

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data