BaselineWatch
60834 CVEs · 136 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known60,834 New, 24 h117 Changed, 24 h130 In KEV136 Public exploit1,639 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-10534 9.8 critical 0.00% ibm, db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser. 23 Oct
CVE-2026-12665 9.8 critical 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. 23 Oct
CVE-2025-0165 9.8 critical 0.00% ibm, watsonx_orchestrate_cartridge_for_ibm_cloud_pak_for_data IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. 18 Oct
CVE-2025-36222 9.8 critical 0.00% ibm, storage_fusion, storage_fusion_hci, storage_fusion_hci_for_watsonx IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions. 18 Oct
CVE-2025-36087 9.8 critical 0.00% ibm, security_verify_access, verify_identity_access IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations, contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. 18 Oct
CVE-2026-19622 9.8 critical 0.00% ibm, planning_analytics IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests. 15 Oct
CVE-2026-84249 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function. 15 Oct
CVE-2026-17618 9.8 critical 0.00% ibm, financial_transaction_manager IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization. 15 Oct
CVE-2026-84198 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 15 Oct
CVE-2026-84209 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. 15 Oct
CVE-2026-16340 9.8 critical 0.00% ibm, datapower_gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser. 15 Oct
CVE-2026-14991 9.8 critical 0.00% ibm, datapower_gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system. 15 Oct
CVE-2026-14269 9.8 critical 0.00% ibm, datapower_gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system. 14 Oct
CVE-2026-14502 9.8 critical 0.00% ibm, datapower_gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication. 14 Oct
CVE-2026-84246 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 14 Oct
CVE-2026-80381 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. 14 Oct
CVE-2026-81932 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. 14 Oct
CVE-2026-82895 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 14 Oct
CVE-2026-84035 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. 14 Oct
CVE-2026-84057 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 14 Oct
CVE-2026-84058 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance. 14 Oct
CVE-2026-14888 9.8 critical 0.00% ibm, datapower_gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. 14 Oct
CVE-2026-14988 9.8 critical 0.00% ibm, datapower_gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow. 14 Oct
CVE-2026-14992 9.8 critical 0.00% ibm, datapower_gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow. 14 Oct
CVE-2026-84272 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters. 10 Oct
CVE-2026-82344 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system. 10 Oct
CVE-2026-82335 9.8 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution. 10 Oct
CVE-2026-16903 9.6 critical 0.00% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code or cause a denial of service due to an out-of-bounds write. Mon 26 Oct
CVE-2026-10140 9.6 critical 0.00% langflow IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution. Sun 25 Oct
CVE-2026-13433 9.6 critical 0.00% ibm, i_access_client_solutions IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation. 23 Oct
CVE-2026-82101 9.6 critical 0.00% ibm, datastage_on_cloud_pak_for_data IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. 14 Oct
CVE-2026-16822 9.3 critical 0.00% ibm, aix, vios IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation. Mon 26 Oct
CVE-2026-11708 9.3 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. Sun 25 Oct
CVE-2026-11712 9.3 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. Sun 25 Oct
CVE-2026-14973 9.3 critical 0.00% ibm, aspera IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination. 23 Oct
CVE-2026-11707 9.3 critical 0.00% ibm, websphere_application_server, tivoli_system_automation_application_manager IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page. 23 Oct
CVE-2025-36356 9.3 critical 0.00% ibm, security_verify_access, security_verify_access_docker, verify_identity_access IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to escalate their privileges to root due to execution with more privileges than required. 18 Oct
CVE-2026-14990 9.3 critical 0.00% no CPE yet IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. 8 Oct
CVE-2026-17003 9.1 critical 0.00% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and integrity of the system due to an out-of-bounds write. Tue 27 Oct
CVE-2026-17423 9.1 critical 0.00% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read. Mon 26 Oct
CVE-2026-18716 9.1 critical 0.00% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read. Mon 26 Oct
CVE-2026-9006 9.1 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure. Sun 25 Oct
CVE-2026-10560 9.1 critical 0.00% langflow IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service. Sun 25 Oct
CVE-2026-13449 9.1 critical 0.00% ibm, business_automation_manager IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Sun 25 Oct
CVE-2026-7874 9.1 critical 0.00% langflow IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest. Sun 25 Oct
CVE-2026-8470 9.1 critical 0.00% langflow IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens. 24 Oct
CVE-2026-93909 9.1 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. 22 Oct
CVE-2026-93895 9.1 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. 22 Oct
CVE-2026-95695 9.1 critical 0.00% ibm, websphere_application_server IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. 22 Oct
CVE-2026-82900 9.1 critical 0.00% ibm, guardium_data_protection IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory. 14 Oct

300 of 844 · Next · Previous

Download these 844 as CSV · subscribe to this list.

EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.