BaselineWatch
59525 CVEs · 135 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known59,525 New, 24 h975 Changed, 24 h1,186 In KEV135 Public exploit1,613 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-6719 7.5 high 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. 19 Oct
CVE-2025-36160 7.5 high 0.00% ibm, concert IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system. 18 Oct
CVE-2025-36150 7.5 high 0.00% ibm, concert IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. 8 Oct
CVE-2026-4413 6.1 medium 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. 19 Oct
CVE-2025-36153 6.1 medium 0.00% ibm, concert IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. 18 Oct
CVE-2025-64649 5.9 medium 0.00% ibm, concert IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation. 19 Oct
CVE-2025-36161 5.9 medium 0.00% ibm, concert IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. 18 Oct
CVE-2025-36084 5.9 medium 0.00% no CPE yet IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. 14 Oct
CVE-2025-36158 5.5 medium 0.00% ibm, concert IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontrolled recursive directory copying. 18 Oct
CVE-2025-36159 5.5 medium 0.00% ibm, concert IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of output. 18 Oct
CVE-2025-36149 5.4 medium 0.00% ibm, concert IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. 8 Oct
CVE-2026-3628 5.3 medium 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions. 22 Oct
CVE-2026-15661 5.3 medium 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files. 22 Oct
CVE-2025-12767 5.3 medium 0.00% no CPE yet IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption. 14 Oct
CVE-2026-1510 4.7 medium 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection. 19 Oct
CVE-2026-4405 4.0 medium 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system. 19 Oct
CVE-2026-3303 3.7 low 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains. 20 Oct
CVE-2026-6930 3.7 low 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. 19 Oct
CVE-2026-1501 3.7 low 0.00% no CPE yet IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation. 19 Oct

19 of 19

Download these 19 as CSV · subscribe to this list.

EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.