Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-76587 | 8.8 high | 1.0% | no CPE yet | IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system. | 23 Oct |
| CVE-2026-19622 | 9.8 critical | 0.00% | ibm, planning_analytics | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests. | 15 Oct |
| CVE-2026-19620 | 8.8 high | 0.00% | ibm, planning_analytics | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication. | 15 Oct |
| CVE-2026-19627 | 8.2 high | 0.00% | ibm, planning_analytics | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths. | 15 Oct |
| CVE-2026-85457 | 8.1 high | 0.00% | no CPE yet | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. | 16 Oct |
| CVE-2026-10545 | 7.5 high | 0.00% | ibm, planning_analytics_local | IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions. | 23 Oct |
| CVE-2026-75061 | 7.5 high | 0.00% | ibm, planning_analytics | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system. | 15 Oct |
| CVE-2026-17475 | 7.1 high | 0.00% | ibm, planning_analytics | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control. | 15 Oct |
| CVE-2026-75063 | 5.4 medium | 0.00% | ibm, planning_analytics | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding. | 15 Oct |
| CVE-2026-18541 | 5.4 medium | 0.00% | ibm, planning_analytics | IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 15 Oct |
| CVE-2025-36437 | 4.3 medium | 0.00% | ibm, planning_analytics_local | IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system. | 14 Oct |
11 of 11
Download these 11 as CSV · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.