Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-90920 | 9.8 critical | 1.0% | no CPE yet | IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | 13 Oct |
| CVE-2026-78401 | 9.8 critical | 1.0% | ibm, security_verify_access, security_verify_access_container, verify_identity_access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | 10 Oct |
| CVE-2026-78406 | 9.8 critical | 1.0% | ibm, security_verify_access, security_verify_access_container, verify_identity_access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | 10 Oct |
| CVE-2026-104334 | 9.8 critical | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | 8 Oct |
| CVE-2026-93675 | 9.8 critical | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. | 8 Oct |
| CVE-2026-16839 | 9.4 critical | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser. | Mon 26 Oct |
| CVE-2026-15091 | 9.3 critical | 1.0% | ibm, engineering_ai_hub | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation. | Sat 24 Oct |
| CVE-2026-15065 | 9.1 critical | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file. | Tue 27 Oct |
| CVE-2026-17060 | 9.1 critical | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read. | Tue 27 Oct |
| CVE-2026-16926 | 9.1 critical | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input. | Mon 26 Oct |
| CVE-2026-18670 | 9.1 critical | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and potentially disclose sensitive information due to an integer underflow. | Mon 26 Oct |
| CVE-2025-12531 | 9.1 critical | 1.0% | ibm, infosphere_information_server | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. | 18 Oct |
| CVE-2025-36236 | 9.1 critical | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system. | 18 Oct |
| CVE-2026-16877 | 8.8 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. | Mon 26 Oct |
| CVE-2026-16842 | 8.8 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | Mon 26 Oct |
| CVE-2026-16844 | 8.8 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | Mon 26 Oct |
| CVE-2026-16848 | 8.8 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options. | Mon 26 Oct |
| CVE-2026-16850 | 8.8 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection via crafted Router Advertisements. | Mon 26 Oct |
| CVE-2026-16911 | 8.8 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack buffer overflow. | Mon 26 Oct |
| CVE-2026-17168 | 8.8 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. | Mon 26 Oct |
| CVE-2026-18824 | 8.8 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | Mon 26 Oct |
| CVE-2026-13759 | 8.8 high | 1.0% | ibm, websphere_extreme_scale | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-login attacker who can write a session attribute or a LAN-adjacent attacker on the grid replication wire to execute arbitrary code on peer WAS JVMs | Sun 25 Oct |
| CVE-2026-14499 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component. | Sat 24 Oct |
| CVE-2026-7667 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary file write operations with attacker-controlled content to any path accessible by the Langflow process. | Sat 24 Oct |
| CVE-2026-7755 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files. | Sat 24 Oct |
| CVE-2026-8056 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function. | Sat 24 Oct |
| CVE-2026-8182 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests. | Sat 24 Oct |
| CVE-2026-8478 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code. | Sat 24 Oct |
| CVE-2026-9196 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process. | Sat 24 Oct |
| CVE-2026-17623 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations. | Fri 23 Oct |
| CVE-2026-17630 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters. | Fri 23 Oct |
| CVE-2026-17624 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports. | Fri 23 Oct |
| CVE-2026-17632 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning. | Fri 23 Oct |
| CVE-2026-18683 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands. | Fri 23 Oct |
| CVE-2026-16856 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command. | Fri 23 Oct |
| CVE-2026-16906 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command. | Fri 23 Oct |
| CVE-2026-17110 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management. | Fri 23 Oct |
| CVE-2026-18669 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority. | Fri 23 Oct |
| CVE-2026-18713 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands. | Fri 23 Oct |
| CVE-2026-17417 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters. | Fri 23 Oct |
| CVE-2026-17642 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | Fri 23 Oct |
| CVE-2026-76587 | 8.8 high | 1.0% | no CPE yet | IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system. | Fri 23 Oct |
| CVE-2026-85029 | 8.8 high | 1.0% | ibm, guardium_data_protection | IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory. | 20 Oct |
| CVE-2026-107400 | 8.8 high | 1.0% | no CPE yet | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. | 20 Oct |
| CVE-2025-36072 | 8.8 high | 1.0% | ibm, webmethods_integration | IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data. | 18 Oct |
| CVE-2025-14754 | 8.8 high | 1.0% | ibm, cloud_pak_for_data | IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input. | 14 Oct |
| CVE-2026-102627 | 8.8 high | 1.0% | no CPE yet | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction. | 13 Oct |
| CVE-2026-16916 | 8.8 high | 1.0% | ibm, security_verify_access, security_verify_access_container, verify_identity_access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure. | 10 Oct |
| CVE-2026-88962 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. | 8 Oct |
| CVE-2026-17636 | 8.8 high | 1.0% | ibm, financial_transaction_manager | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity. | 8 Oct |
Download these 843 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.