Filtered by vendor Ibm Subscriptions
Total 9777 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-108284 1 Ibm 1 Websphere Application Server Liberty 2026-11-08 6.5 Medium
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
CVE-2026-107331 1 Ibm 1 Datastage On Cloud Pak For Data 2026-11-08 9.9 Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
CVE-2026-107330 1 Ibm 1 Datastage On Cloud Pak For Data 2026-11-08 7.7 High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.
CVE-2026-105473 1 Ibm 1 Qradar Security Information And Event Manager 2026-11-08 4.6 Medium
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Open Redirect. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.
CVE-2026-105467 1 Ibm 1 Qradar Security Information And Event Manager 2026-11-08 8.1 High
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.
CVE-2026-103320 1 Ibm 1 Websphere Application Server Liberty 2026-11-08 4.3 Medium
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
CVE-2026-102618 1 Ibm 1 I 2026-11-08 3.6 Low
IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable.
CVE-2026-101117 1 Ibm 1 Websphere Extreme Scale 2026-11-08 9.1 Critical
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.
CVE-2025-36075 1 Ibm 1 Safer Payments 2026-11-08 5.3 Medium
IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.
CVE-2025-1837 1 Ibm 1 Watsonx Orchestrate Cartridge For Cloud Pak For Data 2026-11-08 5.4 Medium
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.
CVE-2025-0166 1 Ibm 1 Watsonx Orchestrate Cartridge For Cloud Pak For Data 2026-11-08 2.7 Low
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible.
CVE-2024-41786 1 Ibm 1 Engineering Requirements Management Doors Next 2026-11-08 5.3 Medium
IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation.
CVE-2026-19131 1 Ibm 1 Api Connect 2026-11-08 6.5 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization.
CVE-2026-19128 1 Ibm 1 Api Connect 2026-11-08 7.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
CVE-2026-19126 1 Ibm 1 Api Connect 2026-11-08 5.9 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2026-19124 1 Ibm 1 Api Connect 2026-11-08 6.8 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained.
CVE-2026-18689 1 Ibm 1 Api Connect 2026-11-08 4.3 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
CVE-2026-18535 1 Ibm 1 Api Connect 2026-11-08 9.6 Critical
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
CVE-2026-17428 1 Ibm 1 Api Connect 2026-11-08 5 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
CVE-2026-17409 1 Ibm 1 Api Connect 2026-11-08 9.4 Critical
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.