Total
227 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-18490 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 8.8 HIGH |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules. | |||||
| CVE-2026-18505 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 5.4 MEDIUM |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attacker can craft a request with a manipulated `Host` header to redirect authenticated operators to attacker-controlled sites, enabling credential phishing. | |||||
| CVE-2026-18872 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 9.3 CRITICAL |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions. | |||||
| CVE-2026-18875 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 7.3 HIGH |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data. | |||||
| CVE-2026-19087 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 4.4 MEDIUM |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper privilege management. | |||||
| CVE-2026-19179 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 8.2 HIGH |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression. | |||||
| CVE-2026-19267 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 6.2 MEDIUM |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`CommandsResource.java:31`). A local actor can invoke unauthenticated commands to cause resource exhaustionand halt business-rule management functions. | |||||
| CVE-2026-18161 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-06 | N/A | 4.3 MEDIUM |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header. | |||||
| CVE-2026-18162 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-06 | N/A | 9.8 CRITICAL |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor. | |||||
| CVE-2026-18163 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-06 | N/A | 9.8 CRITICAL |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data. | |||||
| CVE-2026-18169 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-06 | N/A | 9.9 CRITICAL |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links. | |||||
| CVE-2026-18170 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-06 | N/A | 6.5 MEDIUM |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling. | |||||
| CVE-2023-44487 | 33 Akka, Amazon, Apache and 30 more | 324 Http Server, Opensearch Data Prepper, Apisix and 321 more | 2026-08-11 | N/A | 7.5 HIGH |
| The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. | |||||
| CVE-2026-22549 | 3 F5, Kubernetes, Redhat | 3 Big-ip Container Ingress Services, Kubernetes, Openshift | 2026-06-17 | N/A | 4.9 MEDIUM |
| A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2025-36187 | 2 Ibm, Redhat | 2 Knowledge Catalog, Openshift | 2026-06-17 | N/A | 4.4 MEDIUM |
| IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user. | |||||
| CVE-2024-51465 | 2 Ibm, Redhat | 2 App Connect Enterprise Certified Container, Openshift | 2026-06-17 | N/A | 8.8 HIGH |
| IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. | |||||
| CVE-2024-1485 | 2 Devfile, Redhat | 3 Registry-support, Openshift, Openshift Developer Tools And Services | 2026-06-17 | N/A | 8.0 HIGH |
| A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed. | |||||
| CVE-2023-43058 | 2 Ibm, Redhat | 3 Robotic Process Automation, Robotic Process Automation For Cloud Pak, Openshift | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527. | |||||
| CVE-2023-40694 | 2 Ibm, Redhat | 2 Watson Cp4d Data Stores, Openshift | 2026-06-17 | N/A | 6.2 MEDIUM |
| IBM Watson CP4D Data Stores 4.0.0 through 4.8.4 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 264838. | |||||
| CVE-2023-40370 | 3 Ibm, Microsoft, Redhat | 4 Robotic Process Automation, Robotic Process Automation For Cloud Pak, Windows and 1 more | 2026-06-17 | N/A | 3.7 LOW |
| IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470. | |||||