https://vulnogram.org/ Most recent CVEs assigned by IBM Corporation (ibm). https://vulnogram.org/seaview/icons/ibm.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-76587 https://vulnogram.org/CVE-2026-76587 IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system. High Tue, 20 Oct 2026 22:07:47 GMT https://vulnogram.org/CVE-2026-9825 https://vulnogram.org/CVE-2026-9825 IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks. Low Network Exploitable Tue, 20 Oct 2026 22:02:54 GMT https://vulnogram.org/CVE-2026-81212 https://vulnogram.org/CVE-2026-81212 IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any te… Critical Network Exploitable Tue, 20 Oct 2026 21:58:51 GMT https://vulnogram.org/CVE-2026-82891 https://vulnogram.org/CVE-2026-82891 IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key. High Network Exploitable Tue, 20 Oct 2026 21:55:01 GMT https://vulnogram.org/CVE-2026-87800 https://vulnogram.org/CVE-2026-87800 IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type. Medium Tue, 20 Oct 2026 21:53:18 GMT https://vulnogram.org/CVE-2026-92559 https://vulnogram.org/CVE-2026-92559 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. Critical Network Exploitable Tue, 20 Oct 2026 21:52:22 GMT https://vulnogram.org/CVE-2026-93441 https://vulnogram.org/CVE-2026-93441 IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. High Network Exploitable Tue, 20 Oct 2026 21:51:16 GMT https://vulnogram.org/CVE-2026-93442 https://vulnogram.org/CVE-2026-93442 IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read. High Network Exploitable Tue, 20 Oct 2026 21:48:03 GMT https://vulnogram.org/CVE-2026-93744 https://vulnogram.org/CVE-2026-93744 IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication… Medium Network Exploitable Tue, 20 Oct 2026 21:41:32 GMT https://vulnogram.org/CVE-2026-93888 https://vulnogram.org/CVE-2026-93888 IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input. High Tue, 20 Oct 2026 21:39:48 GMT https://vulnogram.org/CVE-2026-94402 https://vulnogram.org/CVE-2026-94402 IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title… Medium Network Exploitable Tue, 20 Oct 2026 21:31:46 GMT https://vulnogram.org/CVE-2026-105453 https://vulnogram.org/CVE-2026-105453 IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management. High Mon, 19 Oct 2026 23:56:06 GMT https://vulnogram.org/CVE-2026-107366 https://vulnogram.org/CVE-2026-107366 IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire… High Mon, 19 Oct 2026 23:49:23 GMT https://vulnogram.org/CVE-2026-107400 https://vulnogram.org/CVE-2026-107400 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. High Mon, 19 Oct 2026 23:46:46 GMT https://vulnogram.org/CVE-2026-109126 https://vulnogram.org/CVE-2026-109126 IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials. High Mon, 19 Oct 2026 23:43:19 GMT https://vulnogram.org/CVE-2026-8355 https://vulnogram.org/CVE-2026-8355 IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud me… Medium Mon, 19 Oct 2026 23:42:01 GMT https://vulnogram.org/CVE-2025-36061 https://vulnogram.org/CVE-2025-36061 IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts… Medium Mon, 19 Oct 2026 22:51:04 GMT https://vulnogram.org/CVE-2025-36069 https://vulnogram.org/CVE-2025-36069 IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system. Medium Mon, 19 Oct 2026 22:50:54 GMT https://vulnogram.org/CVE-2025-36252 https://vulnogram.org/CVE-2025-36252 IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system. Medium Mon, 19 Oct 2026 22:50:46 GMT https://vulnogram.org/CVE-2026-19178 https://vulnogram.org/CVE-2026-19178 IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition. Medium Mon, 19 Oct 2026 22:50:34 GMT https://vulnogram.org/CVE-2023-38375 https://vulnogram.org/CVE-2023-38375 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure w… Medium Network Exploitable Mon, 19 Oct 2026 17:40:04 GMT https://vulnogram.org/CVE-2026-3161 https://vulnogram.org/CVE-2026-3161 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Medium Network Exploitable Mon, 19 Oct 2026 17:39:57 GMT https://vulnogram.org/CVE-2026-3295 https://vulnogram.org/CVE-2026-3295 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by… High Mon, 19 Oct 2026 17:39:49 GMT https://vulnogram.org/CVE-2026-4418 https://vulnogram.org/CVE-2026-4418 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting… Medium Mon, 19 Oct 2026 17:39:41 GMT https://vulnogram.org/CVE-2026-1501 https://vulnogram.org/CVE-2026-1501 IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation. Low Mon, 19 Oct 2026 17:18:00 GMT https://vulnogram.org/CVE-2026-1510 https://vulnogram.org/CVE-2026-1510 IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection. Medium Mon, 19 Oct 2026 17:17:53 GMT https://vulnogram.org/CVE-2026-3303 https://vulnogram.org/CVE-2026-3303 IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains. Low Network Exploitable Mon, 19 Oct 2026 17:17:45 GMT https://vulnogram.org/CVE-2026-3628 https://vulnogram.org/CVE-2026-3628 IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions. Medium Network Exploitable Mon, 19 Oct 2026 17:17:36 GMT https://vulnogram.org/CVE-2026-4405 https://vulnogram.org/CVE-2026-4405 IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system. Medium Mon, 19 Oct 2026 17:17:27 GMT https://vulnogram.org/CVE-2026-4413 https://vulnogram.org/CVE-2026-4413 IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials di… Medium Network Exploitable Mon, 19 Oct 2026 17:17:18 GMT https://vulnogram.org/CVE-2026-6719 https://vulnogram.org/CVE-2026-6719 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. High Network Exploitable Mon, 19 Oct 2026 17:17:08 GMT https://vulnogram.org/CVE-2026-6930 https://vulnogram.org/CVE-2026-6930 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Low Network Exploitable Mon, 19 Oct 2026 17:11:49 GMT https://vulnogram.org/CVE-2026-15661 https://vulnogram.org/CVE-2026-15661 IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files. Medium Network Exploitable Mon, 19 Oct 2026 17:11:39 GMT https://vulnogram.org/CVE-2026-14511 https://vulnogram.org/CVE-2026-14511 IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications. Medium Mon, 19 Oct 2026 16:43:22 GMT https://vulnogram.org/CVE-2026-10572 https://vulnogram.org/CVE-2026-10572 IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options. High Mon, 19 Oct 2026 16:41:42 GMT https://vulnogram.org/CVE-2026-10574 https://vulnogram.org/CVE-2026-10574 IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. High Mon, 19 Oct 2026 16:41:34 GMT https://vulnogram.org/CVE-2026-10743 https://vulnogram.org/CVE-2026-10743 IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. High Mon, 19 Oct 2026 16:41:25 GMT https://vulnogram.org/CVE-2026-11828 https://vulnogram.org/CVE-2026-11828 IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name le… Medium Network Exploitable Mon, 19 Oct 2026 16:41:17 GMT https://vulnogram.org/CVE-2026-11829 https://vulnogram.org/CVE-2026-11829 IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests. Medium Mon, 19 Oct 2026 16:41:09 GMT https://vulnogram.org/CVE-2026-11831 https://vulnogram.org/CVE-2026-11831 IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request. Medium Mon, 19 Oct 2026 16:41:02 GMT https://vulnogram.org/CVE-2026-12148 https://vulnogram.org/CVE-2026-12148 IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. High Mon, 19 Oct 2026 16:40:55 GMT https://vulnogram.org/CVE-2026-12155 https://vulnogram.org/CVE-2026-12155 IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference. Medium Mon, 19 Oct 2026 16:40:44 GMT https://vulnogram.org/CVE-2026-12343 https://vulnogram.org/CVE-2026-12343 IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations. Medium Mon, 19 Oct 2026 16:40:37 GMT https://vulnogram.org/CVE-2026-12350 https://vulnogram.org/CVE-2026-12350 IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. Medium Mon, 19 Oct 2026 16:40:28 GMT https://vulnogram.org/CVE-2026-12660 https://vulnogram.org/CVE-2026-12660 IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. Low Mon, 19 Oct 2026 16:40:20 GMT https://vulnogram.org/CVE-2026-12665 https://vulnogram.org/CVE-2026-12665 IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. High Network Exploitable Mon, 19 Oct 2026 16:40:12 GMT https://vulnogram.org/CVE-2026-12669 https://vulnogram.org/CVE-2026-12669 IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected. Low Mon, 19 Oct 2026 16:40:03 GMT https://vulnogram.org/CVE-2026-12727 https://vulnogram.org/CVE-2026-12727 IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names. Medium Mon, 19 Oct 2026 16:39:55 GMT https://vulnogram.org/CVE-2026-12670 https://vulnogram.org/CVE-2026-12670 IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion. Medium Mon, 19 Oct 2026 16:39:30 GMT https://vulnogram.org/CVE-2026-17068 https://vulnogram.org/CVE-2026-17068 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag. Medium Fri, 16 Oct 2026 18:39:45 GMT