Export limit exceeded: 24066 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (8966 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86093 | 1 Ibm | 1 Db2 | 2026-09-10 | 7.5 High |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking. | ||||
| CVE-2026-87958 | 1 Ibm | 1 Db2 | 2026-09-10 | 8.1 High |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions. | ||||
| CVE-2026-78658 | 1 Ibm | 2 Ucd Ibm Devops Deploy, Ucd Ibm Urbancode Deploy | 2026-09-10 | 6.5 Medium |
| IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an formation disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted. | ||||
| CVE-2026-19645 | 1 Ibm | 1 Mq Agent | 2026-09-10 | 6.5 Medium |
| IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature. | ||||
| CVE-2026-18658 | 1 Ibm | 1 Operational Decision Manager | 2026-09-10 | 9.8 Critical |
| IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution. | ||||
| CVE-2026-85025 | 1 Ibm | 1 Langflow Oss | 2026-09-10 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls. | ||||
| CVE-2026-9667 | 1 Ibm | 1 Websphere Application Server | 2026-09-10 | 5.3 Medium |
| IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints. | ||||
| CVE-2026-9176 | 1 Ibm | 1 Websphere Application Server | 2026-09-10 | 6.7 Medium |
| IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources. | ||||
| CVE-2026-9225 | 1 Ibm | 1 Langflow Oss | 2026-09-10 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/{flow_id} endpoint, the application allows component inputs to reference storage paths using arbitrary user or flow identifiers without verifying ownership. An attacker with low‑privileged authenticated access can supply a crafted file path pointing to another user’s storage namespace, causing the backend to read and return the contents of files uploaded by other users. This vulnerability bypasses intended authorization checks enforced by the file management API and may result in unauthorized disclosure of sensitive user data. | ||||
| CVE-2026-9327 | 1 Ibm | 1 Websphere Application Server | 2026-09-10 | 6.3 Medium |
| IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service. | ||||
| CVE-2026-8862 | 1 Ibm | 2 Netezza Performance Server, Netezza Software | 2026-09-10 | 7.5 High |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information. | ||||
| CVE-2026-9036 | 1 Ibm | 2 Netezza Performance Server, Netezza Software | 2026-09-10 | 5.9 Medium |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques. | ||||
| CVE-2026-9736 | 1 Ibm | 2 Netezza Performance Server, Netezza Software | 2026-09-10 | 5.3 Medium |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files. | ||||
| CVE-2026-9744 | 1 Ibm | 2 Netezza Performance Server, Netezza Software | 2026-09-10 | 5.3 Medium |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques. | ||||
| CVE-2026-9745 | 1 Ibm | 2 Netezza Performance Server, Netezza Software | 2026-09-10 | 6.5 Medium |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control. | ||||
| CVE-2026-9338 | 1 Ibm | 1 Websphere Application Server | 2026-09-10 | 5.3 Medium |
| IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service. | ||||
| CVE-2026-9336 | 1 Ibm | 1 Websphere Application Server | 2026-09-10 | 6.5 Medium |
| IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space. | ||||
| CVE-2026-19298 | 5 Apple, Ibm, Langflow and 2 more | 5 Macos, Langflow Oss, Langflow and 2 more | 2026-09-10 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process. | ||||
| CVE-2026-18486 | 1 Ibm | 1 Contextforge-mcp-gateway | 2026-09-10 | 8.8 High |
| IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters. | ||||
| CVE-2026-18076 | 1 Ibm | 1 I | 2026-09-10 | 4.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak. | ||||