[ Vendor · 330 CVEs ]
IBM
CVEs affecting IBM published in the last 30 days, plus any IBM CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-6721 | 23 Sep 2026 | CVSS 9.8 | IBM ConcertIBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands… | |
| CVE-2026-3626 | 23 Sep 2026 | CVSS 5.3 | IBM ConcertIBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… | Fix |
| CVE-2026-4921 | 23 Sep 2026 | CVSS 2.7 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is… | |
| CVE-2026-6327 | 23 Sep 2026 | CVSS 4.3 | IBM ConcertIBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements… | Fix |
| CVE-2026-19179 | 23 Sep 2026 | CVSS 8.2 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper… | |
| CVE-2026-19267 | 23 Sep 2026 | CVSS 6.2 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST… | |
| CVE-2026-18181 | 23 Sep 2026 | CVSS 8.1 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information… | |
| CVE-2026-18184 | 23 Sep 2026 | CVSS 7.4 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external… | |
| CVE-2026-18185 | 23 Sep 2026 | CVSS 7.3 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system… | |
| CVE-2026-18490 | 23 Sep 2026 | CVSS 8.8 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization… | |
| CVE-2026-18505 | 23 Sep 2026 | CVSS 5.4 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter`… | |
| CVE-2026-18872 | 23 Sep 2026 | CVSS 9.3 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI… | |
| CVE-2026-18875 | 23 Sep 2026 | CVSS 7.3 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI… | |
| CVE-2026-19087 | 23 Sep 2026 | CVSS 4.4 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to… | |
| CVE-2026-18180 | 23 Sep 2026 | CVSS 6.5 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL… | |
| CVE-2026-18177 | 23 Sep 2026 | CVSS 7.1 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing… | |
| CVE-2026-18179 | 23 Sep 2026 | CVSS 6.5 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper… | |
| CVE-2026-9205 | 5 Aug 2026 | CVSS 7.4 | Langflow: Weak Fernet Key via random.seed()IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function. | Fix |
| CVE-2026-8505 | 17 Jul 2026 | CVSS 9.8 | Langflow: Unauthenticated Flow Execution via Webhook Authentication BypassIBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the… | Fix |
| CVE-2026-9198 | 17 Jul 2026 | CVSS 9.8 | IBM Langflow Code InjectionIBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller)… | Exploited |
| CVE-2026-10561 | 22 Jun 2026 | CVSS 10.0 | Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalationIBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass… | Fix |
| CVE-2022-47986 | 17 Feb 2023 | CVSS 9.8 | IBM Aspera Faspex Code ExecutionIBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML… | ExploitedFix |
| CVE-2020-4427 | 7 May 2020 | CVSS 9.8 | IBM Data Risk Manager Security BypassIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with… | ExploitedFix |
| CVE-2020-4428 | 7 May 2020 | CVSS 9.1 | IBM Data Risk Manager Remote Code ExecutionIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM… | ExploitedFix |
| CVE-2020-4430 | 7 May 2020 | CVSS 4.3 | IBM Data Risk Manager Directory TraversalIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker… | ExploitedFix |
| CVE-2019-4716 | 18 Dec 2019 | CVSS 9.8 | IBM Planning Analytics Remote Code ExecutionIBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and… | ExploitedFix |
| CVE-2015-7450 | 2 Jan 2016 | CVSS 9.8 | IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote… | Exploited |
| CVE-2015-7450 | 2 Jan 2016 | CVSS 9.8 | IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote… | Exploited |
| CVE-2013-3993 | 7 Jul 2014 | CVSS 6.5 | IBM InfoSphere BigInsights Invalid InputIBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted… | Exploited |
| CVE-2013-3993 | 7 Jul 2014 | CVSS 6.5 | IBM InfoSphere BigInsights Invalid InputIBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted… | Exploited |
Page 4 of 4