Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-17642 | 8.8 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | 23 Oct |
| CVE-2026-76587 | 8.8 high | 1.0% | no CPE yet | IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system. | 23 Oct |
| CVE-2026-85029 | 8.8 high | 1.0% | ibm, guardium_data_protection | IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory. | 20 Oct |
| CVE-2026-107400 | 8.8 high | 1.0% | no CPE yet | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. | 20 Oct |
| CVE-2025-36072 | 8.8 high | 1.0% | ibm, webmethods_integration | IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data. | 18 Oct |
| CVE-2025-14754 | 8.8 high | 1.0% | ibm, cloud_pak_for_data | IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input. | 14 Oct |
| CVE-2026-102627 | 8.8 high | 1.0% | no CPE yet | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction. | 13 Oct |
| CVE-2026-16916 | 8.8 high | 1.0% | ibm, security_verify_access, security_verify_access_container, verify_identity_access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure. | 10 Oct |
| CVE-2026-88962 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. | 8 Oct |
| CVE-2026-17636 | 8.8 high | 1.0% | ibm, financial_transaction_manager | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity. | 8 Oct |
| CVE-2026-17637 | 8.8 high | 1.0% | ibm, financial_transaction_manager | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data. | 8 Oct |
| CVE-2026-97678 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation. | 8 Oct |
| CVE-2026-97655 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner. | 8 Oct |
| CVE-2026-97679 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation. | 8 Oct |
| CVE-2026-97676 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape. | 8 Oct |
| CVE-2026-97673 | 8.8 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation. | 8 Oct |
| CVE-2026-18529 | 8.7 high | 1.0% | no CPE yet | IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task. | 14 Oct |
| CVE-2026-11536 | 8.5 high | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. | 23 Oct |
| CVE-2026-17095 | 8.3 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection. | 23 Oct |
| CVE-2026-18235 | 8.3 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation. | 23 Oct |
| CVE-2026-15061 | 8.2 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal. | Tue 27 Oct |
| CVE-2026-16686 | 8.2 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication. | Tue 27 Oct |
| CVE-2026-16857 | 8.2 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network traffic and DNS configuration due to improper authentication. | Mon 26 Oct |
| CVE-2026-17485 | 8.2 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow. | 23 Oct |
| CVE-2026-104317 | 8.1 high | 1.0% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data. | 21 h ago |
| CVE-2026-7872 | 8.1 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user. | Sat 24 Oct |
| CVE-2026-16904 | 8.1 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment. | 23 Oct |
| CVE-2026-82891 | 8.1 high | 1.0% | no CPE yet | IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key. | 23 Oct |
| CVE-2026-14497 | 8.1 high | 1.0% | ibm, datapower_gateway | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures. | 14 Oct |
| CVE-2026-8183 | 7.7 high | 1.0% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to v i ew arbitrary files on the system. | 24 Oct |
| CVE-2026-16907 | 7.6 high | 1.0% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking. | 23 Oct |
| CVE-2026-16817 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. | Tue 27 Oct |
| CVE-2026-16818 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | Tue 27 Oct |
| CVE-2026-16690 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | Tue 27 Oct |
| CVE-2026-16706 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write. | Tue 27 Oct |
| CVE-2026-17120 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a buffer overflow. | Tue 27 Oct |
| CVE-2026-17121 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. | Tue 27 Oct |
| CVE-2026-6732 | 7.5 high | 1.0% | xmlsoft, redhat, libxml2, hardened_images, jboss_core_services | A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable. | Mon 26 Oct |
| CVE-2026-42009 | 7.5 high | 1.0% | gnu, redhat, gnutls, hardened_images, openshift_container_platform | A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service. | Mon 26 Oct |
| CVE-2026-3366 | 7.5 high | 1.0% | ibm, infosphere_optim_test_data_fabrication | IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.2.2, 1.0.2.3, 1.0.2.4, 1.0.2.5, 1.0.2.6, 1.0.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system | Mon 26 Oct |
| CVE-2026-16824 | 7.5 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion. | Mon 26 Oct |
| CVE-2026-16831 | 7.5 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | Mon 26 Oct |
| CVE-2026-16836 | 7.5 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | Mon 26 Oct |
| CVE-2026-16852 | 7.5 high | 1.0% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer overflow. | Mon 26 Oct |
| CVE-2026-16924 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation. | Mon 26 Oct |
| CVE-2026-16928 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow. | Mon 26 Oct |
| CVE-2026-16958 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write. | Mon 26 Oct |
| CVE-2026-16972 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to improper authentication. | Mon 26 Oct |
| CVE-2026-17159 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer overflow. | Mon 26 Oct |
| CVE-2026-17163 | 7.5 high | 1.0% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an array size field. | Mon 26 Oct |
Download these 844 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.