Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-7876 | 9.1 critical | 0.00% | ibm, aspera_high-speed_transfer_server_for_cloud_pak_for_integration | IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place. | 14 Oct |
| CVE-2026-14508 | 9.1 critical | 0.00% | ibm, datapower_gateway | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free. | 14 Oct |
| CVE-2026-82334 | 9.1 critical | 0.00% | ibm, guardium_data_protection | IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service. | 10 Oct |
| CVE-2026-17635 | 9.1 critical | 0.00% | ibm, financial_transaction_manager | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints. | 8 Oct |
| CVE-2026-110196 | 8.8 high | 0.00% | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs. | Fri 30 Oct |
| CVE-2026-16814 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. | Tue 27 Oct |
| CVE-2026-16996 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an integer underflow. | Tue 27 Oct |
| CVE-2026-6543 | 8.8 high | 0.00% | langflow, langflow_desktop | IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network. | Mon 26 Oct |
| CVE-2026-5065 | 8.8 high | 0.00% | ibm, controller | IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. | Mon 26 Oct |
| CVE-2026-7870 | 8.8 high | 0.00% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. | Mon 26 Oct |
| CVE-2026-16901 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. | Mon 26 Oct |
| CVE-2026-16909 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an off-by-one error in bounds checking. | Mon 26 Oct |
| CVE-2026-16841 | 8.8 high | 0.00% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. | Mon 26 Oct |
| CVE-2026-16847 | 8.8 high | 0.00% | ibm, aix, vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. | Mon 26 Oct |
| CVE-2026-16932 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable. | Mon 26 Oct |
| CVE-2026-16934 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap-based buffer overflow. | Mon 26 Oct |
| CVE-2026-16936 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow. | Mon 26 Oct |
| CVE-2026-17422 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow. | Mon 26 Oct |
| CVE-2026-19442 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in denial of service, privilege escalation, or full compromise of the client LPAR kernel. | Mon 26 Oct |
| CVE-2026-19449 | 8.8 high | 0.00% | ibm, vios, aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payload as root. | Mon 26 Oct |
| CVE-2026-8858 | 8.8 high | 0.00% | ibm, i | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in. | Sun 25 Oct |
| CVE-2026-9201 | 8.8 high | 0.00% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application validates component code using a truncated SHA‑256 hash. Because the hash comparison relies on only a portion of the digest, an attacker can craft malicious component code that collides with a trusted template hash and bypasses validation. Successful exploitation allows the attacker to introduce and execute unauthorized Python code within the Langflow process, defeating the intended security control and potentially leading to full compromise of the affected instance. | 24 Oct |
| CVE-2026-7868 | 8.8 high | 0.00% | ibm, power_system_s1122_\(9824-22a\)_firmware, power_system_s1124_\(9824-42a\)_firmware, power_system_s1122s_\(9824-22b\)_firmware | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges. | 24 Oct |
| CVE-2026-2482 | 8.8 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | 24 Oct |
| CVE-2026-14980 | 8.8 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled. | 23 Oct |
| CVE-2026-13477 | 8.8 high | 0.00% | ibm, qradar_security_information_and_event_manager | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input. | 23 Oct |
| CVE-2026-17626 | 8.8 high | 0.00% | langflow | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments. | 23 Oct |
| CVE-2026-12148 | 8.8 high | 0.00% | ibm, mq_operator, supplied_mq_advanced_container_images | IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. | 23 Oct |
| CVE-2026-13361 | 8.8 high | 0.00% | ibm, informix_dynamic_server | IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field. | 23 Oct |
| CVE-2026-17082 | 8.8 high | 0.00% | ibm, i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name. | 23 Oct |
| CVE-2026-13105 | 8.8 high | 0.00% | ibm, i_access_client_solutions | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration. | 23 Oct |
| CVE-2026-10572 | 8.8 high | 0.00% | ibm, mq_operator, supplied_mq_advanced_container_images | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options. | 23 Oct |
| CVE-2026-10574 | 8.8 high | 0.00% | ibm, mq_operator, supplied_mq_advanced_container_images | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. | 23 Oct |
| CVE-2026-10743 | 8.8 high | 0.00% | ibm, mq_operator, supplied_mq_advanced_container_images | IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. | 23 Oct |
| CVE-2026-84884 | 8.8 high | 0.00% | ibm, guardium_data_protection | IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token. | 20 Oct |
| CVE-2026-109126 | 8.8 high | 0.00% | no CPE yet | IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials. | 20 Oct |
| CVE-2025-36367 | 8.8 high | 0.00% | ibm, i | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use the elevated privileges of another user profile to gain root access to the host operating system. | 18 Oct |
| CVE-2026-19620 | 8.8 high | 0.00% | ibm, planning_analytics | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication. | 15 Oct |
| CVE-2026-84875 | 8.8 high | 0.00% | ibm, guardium_data_protection | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | 15 Oct |
| CVE-2026-82096 | 8.8 high | 0.00% | ibm, datastage_on_cloud_pak_for_data | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | 14 Oct |
| CVE-2026-82108 | 8.8 high | 0.00% | ibm, datastage_on_cloud_pak_for_data | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | 14 Oct |
| CVE-2025-36375 | 8.8 high | 0.00% | ibm, datapower_gateway | IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | 14 Oct |
| CVE-2026-105464 | 8.8 high | 0.00% | no CPE yet | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management. | 13 Oct |
| CVE-2026-105465 | 8.8 high | 0.00% | no CPE yet | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. | 13 Oct |
| CVE-2026-78388 | 8.8 high | 0.00% | ibm, security_verify_access, security_verify_access_container, verify_identity_access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | 12 Oct |
| CVE-2026-19482 | 8.8 high | 0.00% | ibm, security_verify_access, security_verify_access_container, verify_identity_access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments. | 10 Oct |
| CVE-2026-18740 | 8.8 high | 0.00% | ibm, security_verify_access, security_verify_access_container, verify_identity_access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection. | 10 Oct |
| CVE-2025-36245 | 8.8 high | 0.00% | ibm, infosphere_information_server | IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input. | 9 Oct |
| CVE-2026-93443 | 8.8 high | 0.00% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code. | 8 Oct |
| CVE-2026-93449 | 8.8 high | 0.00% | langflow | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. | 8 Oct |
Download these 844 as CSV · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.