BaselineWatch
58767 CVEs · 135 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,767 New, 24 h1,181 Changed, 24 h1,458 In KEV135 Public exploit1,592 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-17118 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability. Tue 27 Oct
CVE-2026-17122 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. Tue 27 Oct
CVE-2026-17136 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability. Tue 27 Oct
CVE-2026-17138 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. Tue 27 Oct
CVE-2026-17141 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. Tue 27 Oct
CVE-2026-17142 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication. Tue 27 Oct
CVE-2026-17145 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management. Tue 27 Oct
CVE-2026-7524 9.8 critical 1.0% langflow IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction. Mon 26 Oct
CVE-2026-16882 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. Mon 26 Oct
CVE-2026-16885 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. Mon 26 Oct
CVE-2026-16894 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. Mon 26 Oct
CVE-2026-16834 9.8 critical 1.0% ibm, aix, vios IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow. Mon 26 Oct
CVE-2026-16840 9.8 critical 1.0% ibm, aix, vios IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. Mon 26 Oct
CVE-2026-16845 9.8 critical 1.0% ibm, aix, vios IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. Mon 26 Oct
CVE-2026-16862 9.8 critical 1.0% ibm, aix, vios IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. Mon 26 Oct
CVE-2026-16864 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. Mon 26 Oct
CVE-2026-16913 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. Mon 26 Oct
CVE-2026-16917 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow. Mon 26 Oct
CVE-2026-16919 9.8 critical 1.0% ibm, aix, vios IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers. Mon 26 Oct
CVE-2026-17152 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. Mon 26 Oct
CVE-2026-17157 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. Mon 26 Oct
CVE-2026-17160 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation. Mon 26 Oct
CVE-2026-17436 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. Mon 26 Oct
CVE-2026-18832 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. Mon 26 Oct
CVE-2026-19437 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. Mon 26 Oct
CVE-2026-9072 9.8 critical 1.0% ibm, i IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in. Sun 25 Oct
CVE-2026-10109 9.8 critical 1.0% ibm, db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling. Sun 25 Oct
CVE-2026-7663 9.8 critical 1.0% langflow IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint. Sun 25 Oct
CVE-2026-7803 9.8 critical 1.0% langflow IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields. Sun 25 Oct
CVE-2026-7871 9.8 critical 1.0% langflow IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity. Sun 25 Oct
CVE-2026-9074 9.8 critical 1.0% ibm, api_connect IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality. Sun 25 Oct
CVE-2026-9202 9.8 critical 1.0% langflow IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN. Sat 24 Oct
CVE-2026-13448 9.8 critical 1.0% langflow IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent. Sat 24 Oct
CVE-2026-13473 9.8 critical 1.0% ibm, storage_protect IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. Sat 24 Oct
CVE-2026-8505 9.8 critical 1.0% langflow IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE). Sat 24 Oct
CVE-2026-14446 9.8 critical 1.0% ibm, websphere_application_server IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console. Fri 23 Oct
CVE-2026-14512 9.8 critical 1.0% ibm, websphere_application_server IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code. Fri 23 Oct
CVE-2026-14974 9.8 critical 1.0% ibm, websphere_application_server IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data. Fri 23 Oct
CVE-2026-14976 9.8 critical 1.0% ibm, websphere_application_server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled. Fri 23 Oct
CVE-2026-14522 9.8 critical 1.0% ibm, app_connect_enterprise IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters. Fri 23 Oct
CVE-2026-15435 9.8 critical 1.0% ibm, app_connect_enterprise IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system. Fri 23 Oct
CVE-2026-10025 9.8 critical 1.0% ibm, qradar_security_information_and_event_manager IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication. Fri 23 Oct
CVE-2026-16956 9.8 critical 1.0% ibm, db2_mirror_for_i IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. Fri 23 Oct
CVE-2026-17218 9.8 critical 1.0% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. Fri 23 Oct
CVE-2026-17083 9.8 critical 1.0% ibm, i IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. Fri 23 Oct
CVE-2026-92559 9.8 critical 1.0% no CPE yet IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. Fri 23 Oct
CVE-2025-36250 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346. 18 Oct
CVE-2025-36251 9.8 critical 1.0% ibm, vios, aix IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347. 18 Oct
CVE-2026-15762 9.8 critical 1.0% ibm, datapower_gateway IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. 15 Oct
CVE-2026-75875 9.8 critical 1.0% ibm, guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal. 14 Oct

100 of 843 · Next · Previous

Download these 843 as CSV · subscribe to this list.

EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.