Cross-site scripting (CWE-79) in IBM Engineering AI Hub (CVE-2026-15091)

CVE-2026-15091 is a cross-site scripting (CWE-79) vulnerability in IBM Engineering AI Hub caused by improper neutralization of input during web page generation. A remote attacker could exploit this flaw to execute arbitrary scripts, with a CVSS base score of 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating high impact to confidentiality and integrity. Affected versions: - 1.0.0 - 1.1.0 - 1.2.0 We recommend updating to: 1.3.0. CVSS 9.3 · our assessment: act_now Vendor advisory: https://www.ibm.com/support/pages/node/7279964 Details: https://vuln.today/cve/CVE-2026-15091