IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-11595IBM WebSphere Application Server is affected by a Path Traversal vulnerability
- CVE-2026-11708IBM WebSphere Application Server is affected by a cross-site scripting vulnerability
- CVE-2026-11712IBM WebSphere Application Server is affected by a cross-site scripting vulnerability
- CVE-2026-11714IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability
- CVE-2026-11806IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability
- CVE-2026-11906IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user
- CVE-2026-12084IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains
- CVE-2026-12085IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptable to an Insertion of Sensitive Information Into Sent Data vulnerability
- CVE-2026-12086IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Insertion of Sensitive Information into Log File Vulnerability
- CVE-2026-13449XXE attack in IBM Business Automation Manager Open Editions
- CVE-2026-13759IBM WebSphere eXtreme Scale is affected by Insecure Deserilization
- CVE-2026-13772IBM WebSphere eXtreme Scale's OQL is affected by remote code execution
- CVE-2026-13773IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol
- CVE-2026-3602IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection
- CVE-2026-7663Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass
- CVE-2026-7803Flow Validation Bypass via Empty Component Type Field
- CVE-2026-7871Insecure Deserialization in Redis Cache Backend
- CVE-2026-7873Code Injection Vulnerability in Code Validation Endpoint
- CVE-2026-7874Weak Cryptographic Key Derivation Exposed All Stored Credentials
- CVE-2026-9002IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled
- CVE-2026-9836IBM DataStage Flow Designer application is affected by an information disclosure vulnerability
- CVE-2026-10852Websphere Application Server is Affected By a Denial of Service
- CVE-2026-7253IBM Sterling File Gateway SQL Injection
- CVE-2026-9320IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- CVE-2026-9071IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption
- CVE-2026-9006IBM WebSphere Application Server is affected by server-side request forgery
- CVE-2026-8646IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- CVE-2026-10845IBM WebSphere Application Server is affected by an authentication bypass vulnerability
- CVE-2024-51454IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed
- CVE-2023-33854Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.