Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-14959 | 7.2 high | 2.0% | ibm, aspera_faspex | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection. | 23 Oct |
| CVE-2026-14958 | 7.2 high | 1.0% | ibm, aspera_faspex | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. | 23 Oct |
| CVE-2026-14973 | 9.3 critical | 0.00% | ibm, aspera | IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination. | 23 Oct |
| CVE-2026-7876 | 9.1 critical | 0.00% | ibm, aspera_high-speed_transfer_server_for_cloud_pak_for_integration | IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place. | 14 Oct |
| CVE-2026-14996 | 8.2 high | 0.00% | ibm, aspera_faspex | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management. | 23 Oct |
| CVE-2026-75782 | 7.8 high | 0.00% | no CPE yet | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable. | 13 Oct |
| CVE-2026-75095 | 7.5 high | 0.00% | no CPE yet | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | 13 Oct |
| CVE-2025-36274 | 7.5 high | 0.00% | ibm, aspera_http_gateway | IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. | 11 Oct |
| CVE-2026-11980 | 7.3 high | 0.00% | ibm, aspera | IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. | 23 Oct |
| CVE-2026-75621 | 6.2 medium | 0.00% | no CPE yet | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account. | 13 Oct |
| CVE-2026-92832 | 5.1 medium | 0.00% | no CPE yet | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information. | 13 Oct |
| CVE-2025-36171 | 4.9 medium | 0.00% | ibm, aspera_faspex | IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption. | 8 Oct |
| CVE-2026-75076 | 4.3 medium | 0.00% | no CPE yet | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files. | 13 Oct |
| CVE-2025-36225 | 4.3 medium | 0.00% | ibm, aspera_faspex | IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data. | 8 Oct |
14 of 14
Download these 14 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.