BaselineWatch
60829 CVEs · 136 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known60,829 New, 24 h1,256 Changed, 24 h1,332 In KEV136 Public exploit1,639 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-17165 7.5 high 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. Mon 26 Oct
CVE-2026-17170 7.5 high 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size. Mon 26 Oct
CVE-2026-17425 7.5 high 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack buffer overflow. Mon 26 Oct
CVE-2026-18828 7.5 high 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow. Mon 26 Oct
CVE-2026-19446 7.5 high 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart. Mon 26 Oct
CVE-2026-11595 7.5 high 1.0% ibm, websphere_application_server IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system. Sun 25 Oct
CVE-2026-9171 7.5 high 1.0% ibm, powervm_novalink IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. Sat 24 Oct
CVE-2026-14979 7.5 high 1.0% ibm, engineering_lifecycle_management IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion. Sat 24 Oct
CVE-2026-15322 7.5 high 1.0% ibm, engineering_ai_hub IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs. Sat 24 Oct
CVE-2026-15280 7.5 high 1.0% ibm, websphere_application_server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism. 23 Oct
CVE-2026-11897 7.5 high 1.0% ibm, websphere_application_server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. 23 Oct
CVE-2026-14519 7.5 high 1.0% ibm, app_connect_enterprise IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability. 23 Oct
CVE-2026-16308 7.5 high 1.0% no CPE yet IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes. 23 Oct
CVE-2026-12942 7.5 high 1.0% langflow IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system. 23 Oct
CVE-2026-16931 7.5 high 1.0% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options. 23 Oct
CVE-2026-17271 7.5 high 1.0% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size. 23 Oct
CVE-2026-2100 7.5 high 1.0% p11-kit_project, redhat, p11-kit, hardened_images, enterprise_linux A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states. 14 Oct
CVE-2026-4410 7.5 high 1.0% ibm, websphere_application_server IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. 14 Oct
CVE-2025-14753 7.5 high 1.0% ibm, cloud_pak_for_data IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. 14 Oct
CVE-2025-6021 7.5 high 1.0% xmlsoft, redhat, libxml2, jboss_core_services, openshift_container_platform A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. 12 Oct
CVE-2025-36128 7.5 high 1.0% ibm, mq IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service. 9 Oct
CVE-2026-14958 7.2 high 1.0% ibm, aspera_faspex IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. 23 Oct
CVE-2026-12005 7.2 high 1.0% ibm, security_verify_access, verify_identity_access, verify_identity_access_container IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request. 23 Oct
CVE-2026-17094 7.1 high 1.0% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability. 23 Oct
CVE-2026-87800 6.8 medium 1.0% no CPE yet IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type. 21 Oct
CVE-2026-104309 6.5 medium 1.0% ibm, langflow oss IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. Thu 29 Oct
CVE-2026-7658 6.5 medium 1.0% langflow IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation. 24 Oct
CVE-2026-10700 6.5 medium 1.0% langflow IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/{flow_id}/{file_name} endpoint does not enforce authentication or authorization checks, allowing unauthenticated remote attackers to retrieve image files associated with any flow by specifying a valid flow_id and file_name.Additionally, the /api/v1/files/download/{flow_id}/{file_name} endpoint requires authentication but fails to properly validate ownership of the requested resource. As a result, an authenticated user can access files belonging to other users by supplying arbitrary identifiers, leading to an authorization bypass (IDOR).Successful exploitation may result in unauthorized disclosure of sensitive data, including files stored in private flows. This issue breaks tenant isolation in multi-user deployments. 23 Oct
CVE-2026-17266 6.5 medium 1.0% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. 23 Oct
CVE-2026-97671 6.5 medium 1.0% langflow IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability. 8 Oct
CVE-2026-81212 10.0 critical 0.00% no CPE yet IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters. Wed 28 Oct
CVE-2025-15399 10.0 critical 0.00% no CPE yet IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. 14 Oct
CVE-2026-17276 9.9 critical 0.00% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads. 23 Oct
CVE-2026-96012 9.9 critical 0.00% no CPE yet IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system. 13 Oct
CVE-2026-17024 9.8 critical 0.00% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation. Tue 27 Oct
CVE-2026-5935 9.8 critical 0.00% ibm, total_storage_service_console, ts4500_imc IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input. Mon 26 Oct
CVE-2026-4101 9.8 critical 0.00% ibm, security_verify_access, security_verify_access_container, verify_identity_access IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 under certain load conditions could allow an attacker to bypass authentication mechanisms and gain unauthorized access to the application. Mon 26 Oct
CVE-2026-2311 9.8 critical 0.00% ibm, i IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. A malicious actor could cause user-controlled code to run with administrator privilege. Mon 26 Oct
CVE-2026-7664 9.8 critical 0.00% langflow IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint. Sun 25 Oct
CVE-2026-11546 9.8 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Sun 25 Oct
CVE-2026-11714 9.8 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled. Sun 25 Oct
CVE-2026-11541 9.8 critical 0.00% ibm, websphere_application_server IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. Sun 25 Oct
CVE-2026-3144 9.8 critical 0.00% ibm, api_connect IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update. Sun 25 Oct
CVE-2026-13446 9.8 critical 0.00% langflow IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Sat 24 Oct
CVE-2026-9205 9.8 critical 0.00% langflow IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function. 24 Oct
CVE-2026-16184 9.8 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. 23 Oct
CVE-2026-17617 9.8 critical 0.00% ibm, application_gateway_operator IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources. 23 Oct
CVE-2026-18847 9.8 critical 0.00% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i. 23 Oct
CVE-2026-17111 9.8 critical 0.00% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. 23 Oct
CVE-2026-10543 9.8 critical 0.00% ibm, db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query. 23 Oct

250 of 844 · Next · Previous

Download these 844 as CSV · subscribe to this list.

EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.