Total
395675 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-17416 | 2026-09-16 | N/A | 7.8 HIGH | ||
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization. | |||||
| CVE-2026-18515 | 2026-09-16 | N/A | 4.3 MEDIUM | ||
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but only if the profile could already do that by itself. | |||||
| CVE-2026-16432 | 2026-09-16 | N/A | 7.7 HIGH | ||
| IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection. | |||||
| CVE-2026-16466 | 2026-09-16 | N/A | 8.8 HIGH | ||
| IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection. | |||||
| CVE-2026-16185 | 2026-09-16 | N/A | 6.4 MEDIUM | ||
| IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet. | |||||
| CVE-2026-17156 | 2026-09-16 | N/A | 7.8 HIGH | ||
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization. | |||||
| CVE-2026-16702 | 2026-09-16 | N/A | 6.5 MEDIUM | ||
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference. | |||||
| CVE-2026-17047 | 2026-09-16 | N/A | 5.4 MEDIUM | ||
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation. | |||||
| CVE-2026-12742 | 2026-09-16 | N/A | 5.4 MEDIUM | ||
| IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls. | |||||
| CVE-2026-16335 | 2026-09-16 | N/A | 8.1 HIGH | ||
| IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability. | |||||
| CVE-2026-17133 | 2026-09-16 | N/A | 7.8 HIGH | ||
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-18251 | 2026-09-16 | N/A | 4.3 MEDIUM | ||
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin. | |||||
| CVE-2026-16188 | 2026-09-16 | N/A | 5.3 MEDIUM | ||
| IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. | |||||
| CVE-2026-19543 | 2026-09-16 | N/A | 6.2 MEDIUM | ||
| IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior. | |||||
| CVE-2026-16338 | 2026-09-16 | N/A | 9.9 CRITICAL | ||
| IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths. | |||||
| CVE-2026-11926 | 2026-09-16 | N/A | 7.5 HIGH | ||
| IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. | |||||
| CVE-2026-12358 | 2026-09-16 | N/A | 7.5 HIGH | ||
| IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. | |||||
| CVE-2026-15396 | 2026-09-16 | N/A | 6.5 MEDIUM | ||
| IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. | |||||
| CVE-2026-18151 | 2026-09-16 | N/A | 4.2 MEDIUM | ||
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process. | |||||
| CVE-2026-17628 | 2026-09-16 | N/A | 5.4 MEDIUM | ||
| IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication. | |||||