IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-9103Unauthenticated Superuser Token Issuance via Auto-Login Endpoint
- CVE-2026-9135Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation
- CVE-2026-9171Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink.
- CVE-2026-9198Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
- CVE-2026-9202Unauthenticated User Registration Could Lead to Remote Code Execution
- CVE-2026-9762IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
- CVE-2026-9074IBM API Connect SQL Injection
- CVE-2026-3144IBM API Connect Default Credentials
- CVE-2026-11541Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.
- CVE-2026-11594IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities
- CVE-2025-12530Vulnerabilities found in Watson Data Intelligence
- CVE-2025-36319Vulnerabilities found in Watson Data Intelligence
- CVE-2025-36320Vulnerabilities found in Watson Data Intelligence
- CVE-2025-36321Vulnerabilities found in Watson Data Intelligence
- CVE-2025-36323Vulnerabilities found in Watson Data Intelligence
- CVE-2025-36324Vulnerabilities found in Watson Data Intelligence
- CVE-2025-36327Vulnerabilities found in Watson Data Intelligence
- CVE-2025-36328Error Message Containing Sensitive Information found in Watson Data Intelligence
- CVE-2025-36333Vulnerabilities found in Watson Data Intelligence
- CVE-2025-36336Cleartext Transmission of Sensitive Information in Watson Data Intelligence
- CVE-2025-36359IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.
- CVE-2025-36372IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables
- CVE-2026-10109IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling
- CVE-2026-10129SSRF via HTTP Redirect Following in Langflow API Request Component
- CVE-2026-10134Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows
- CVE-2026-10140Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem
- CVE-2026-10546DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component
- CVE-2026-10560Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS
- CVE-2026-10564SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection
- CVE-2026-11546IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability