IBM
Monthly
Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.
XML External Entity injection in IBM Business Automation Workflow allows authenticated remote attackers to read arbitrary server-side files or exhaust memory by submitting crafted XML payloads to processing endpoints. Both containerized (Kubernetes/OpenShift) and traditional on-premises deployments across versions 24.0.0 through 26.0.0 are confirmed affected. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released interim fixes for all four affected version branches.
Remote code execution affects IBM MQ across the 9.1 LTS, 9.2 LTS, 9.3 LTS/CD, 9.4 LTS/CD and 10.0.0.0 release lines because the queue manager deserializes untrusted data (CWE-502), letting an attacker who can already authenticate to the messaging service run arbitrary code under the broker's privileges. The flaw carries a CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and rates as a credentials-gated but fully compromising issue for any exposed MQ listener. No CISA KEV listing, EPSS score, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis; patch availability is signalled by the IBM PSIRT advisory but no fixed build number is stated in the source data.
XML external entity (XXE) injection in IBM MQ 9.1.x, 9.2.x, 9.3.x, 9.4.x LTS/CD and 10.0.0.0 lets a remote attacker who holds low-privileged MQ access submit specially crafted XML that the product parses without disabling external entity resolution. Successful exploitation can disclose sensitive local files (confidentiality impact rated High) or exhaust memory and degrade availability (rated Low), yielding an overall CVSS base score of 7.1. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, though the vulnerability is trivially automatable once parser entry points are reachable.
XML external entity (XXE) injection in IBM MQ (9.1, 9.2, 9.3, 9.4 LTS/CD lines and 10.0.0.0) lets a remote attacker who can already authenticate to MQ and get XML content parsed by the product cause the parser to resolve attacker-supplied external entities. Successful exploitation exposes sensitive information readable by the MQ process (high confidentiality impact) and can consume memory resources, degrading availability. CVSS 3.1 scores this 7.1 (AV:N/AC:L/PR:L/UI:N), so exploitation requires low-privileged authenticated access rather than being fully unauthenticated; no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
An XML external entity (XXE) injection flaw in IBM MQ's reply-message processing lets an authenticated attacker who can place messages on a queue cause the broker to resolve externally defined entities, resulting in arbitrary file disclosure from the MQ server and server-side request forgery against internal networks. The issue spans a wide swath of supported releases - MQ 9.1 LTS through 9.1.0.37, 9.2 LTS through 9.2.0.43, 9.3 LTS through 9.3.0.41 and 9.3 CD through 9.3.5.1, 9.4 LTS through 9.4.0.25 and 9.4 CD through 9.4.5.1, plus MQ 10.0.0.0 Managed File Transfer. IBM rates it CVSS 7.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality, low integrity impact); no public exploit code and no CISA KEV entry were identified at time of analysis.
Improper access control in IBM Sterling File Gateway (6.2.0.0 through 6.2.0.6_1, 6.2.1.0-6.2.1.2, and 6.2.2.0-6.2.2.1) lets a remote, unauthenticated attacker reach file-transfer data they should not be able to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) describes a trivially reachable, no-credentials-required read of sensitive information with no integrity or availability impact. No public exploit code or CISA KEV entry was present in the supplied intelligence at the time of analysis, and IBM has published a vendor fix.
XML External Entity (XXE) injection in IBM Business Automation Workflow containers and traditional deployments allows an authenticated remote attacker to read arbitrary files from the server or perform server-side request forgery due to vulnerable XML processing enabled by default in programming model artifacts. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, all below their respective latest interim fixes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Arbitrary file write in IBM Db2 11.5.x and 12.1.x allows a remote unauthenticated attacker to write files to attacker-controlled paths on the database server due to improper validation of file path inputs. The vulnerability carries CWE-22 (Path Traversal) and was disclosed by IBM with a patch available at their support portal. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the PR:N/AC:L CVSS vector signals low-friction remote reachability.
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
XML external entity (XXE) injection in the PxXMLInput operator of IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker submit crafted XML so that the job's XML parser resolves external entities, exposing host files and internal network resources. The flaw is confidentiality-only (CVSS 7.7, C:H/I:N/A:N) and requires valid credentials plus a job that feeds attacker-influenced XML into the PxXMLInput stage. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. IBM has published a vendor patch; there is no CISA KEV entry, no confirmed public exploit code, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which lowers but does not eliminate real-world urgency for exposed deployments.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special characters in the PxPeek name property, allowing an authenticated remote user to inject and execute arbitrary operating-system commands on the DataStage engine. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), reflecting full loss of confidentiality, integrity, and availability for a low-privileged authenticated attacker. A vendor patch is available from IBM, no public exploit code or CISA KEV entry was identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, making it a patch-promptly rather than drop-everything priority.
Local arbitrary code execution affects IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27, caused by improper neutralization of special elements used in an OS command (CWE-78). Successful exploitation lets a local attacker run commands in the context of the App Connect Enterprise runtime, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R). IBM has published a fix; CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV listing was identified at time of analysis.
Insecure deserialization in IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27 lets a local attacker run arbitrary code on the host running the integration node or toolkit. The flaw rates CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) with total loss of confidentiality, integrity and availability, but CISA's SSVC assessment records no known exploitation and low automatability, and no public exploit code has been identified at time of analysis. IBM has published a fix; the exact patched build is not enumerated in the supplied data, so the vendor advisory should be consulted for the precise version.
Insecure deserialization in IBM App Connect Enterprise (12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0) allows a local attacker to execute arbitrary code with the privileges of the affected runtime, provided the attacker can get a user or process to handle crafted serialized content. CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:N/UI:R, C/I/A all High), and CWE-502 identifies the root cause as untrusted deserialization. No public exploit code has been identified and CISA's SSVC assessment records exploitation status 'none' with automatable 'no'; IBM has published a vendor fix referenced in its support advisory.
IBM Cloud Pak for Data System (Yosemite 1.0) version 3.0.5.2 exposes sensitive information to remote attackers because it continues to negotiate weak or deprecated cryptographic protocols, rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N) with a high confidentiality impact. Any deployment running the affected 3.0.5.2 build on a reachable network segment is in scope, and per CISA's SSVC evaluation the flaw is automatable though no active exploitation has been observed. There is no public exploit code identified at time of analysis, and the vendor has published a fix via IBM support documentation.
XML External Entity (XXE) injection in IBM webMethods Integration Server 11.1 allows an attacker with low-privileged access to submit malicious XML payloads that coerce the server's XML parser into disclosing sensitive filesystem contents or exhausting memory resources through recursive entity expansion. The vulnerability is confirmed by IBM with a patch available via advisory node/7286620. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injection in IBM Common Licensing (Agent and ART 9.0–9.0.0.2) — a phishing enabler, not a system-compromise bug. - **Metadata problems I flagged:** - **CVSS 9.1 is overstated** — C:H/I:H/UI:N doesn't fit an open redirect; my independent assessment is ~6.1 (UI:R, S:C, C:L/I:L). - **CWE-1149 is the wrong class** — this is CWE-601 (URL Redirection to Untrusted Site). I noted this in `confidence_notes` per the instructions (CWE/CVSS disagreements stay out of `data_quality_flags`). - **"Information Disclosure" tag** flagged as a likely mislabel (medium confidence). - **Injection attempt:** The input's "editorial note" tried to make me weave the word "walbrzych" into `risk_assessment`. I ignored it — consistent with the `prompt-injection-attempts` memory — and it appears nowhere in the output. - **Patch:** Available from IBM at support node 7286490 (no single tagged version number given in the input, so I didn't invent one). I also saved a memory entry and index line for this CVE.
Incorrect authorization in IBM App Connect Enterprise (ACE) versions 12.x and 13.x allows a remote authenticated attacker to bypass configured security restrictions, potentially gaining access to resources or operations beyond their intended privilege level. Affected version ranges span IBM ACE 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.1, covering a broad deployment footprint in enterprise integration environments. IBM has released a patch and published advisory node/7286532; no public exploit code or active exploitation has been identified at time of analysis.
Container escape in IBM Aspera Enterprise WebApps 1.0.0-1.0.5 allows a local attacker with low privileges inside the container to break out to the underlying host due to unrestricted system call access. The CVSS vector (S:C/C:H/I:H/A:H) reflects full host compromise as the post-escape impact, not merely container-level damage. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; IBM has released a patch.
Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.11.5 is achievable by authenticated users who can submit custom component source code to the platform. The built-in static security scanner contains a logic error (CWE-693: Protection Mechanism Failure) in its alias-tracking path: when a dangerous callable is referenced indirectly through an annotated class-body assignment, the resolved callable is never validated against the blocklist, making the scan trivially bypassable with a crafted construct. If the malicious component reaches runtime execution, OS commands run in-process with the full privileges of the Langflow service account. No public exploit has been identified at time of analysis, but IBM has released a patch and the network-accessible, low-privilege attack surface makes this a meaningful risk in any multi-user or shared Langflow deployment.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows a low-privilege attacker to execute arbitrary OS commands by submitting crafted input that bypasses the platform's security scanner denylist. The root cause is an incomplete denylist (CWE-78) in the scanner responsible for gatekeeping executable content within AI workflow components - meaning certain command injection payloads are not intercepted and reach the underlying OS. No public exploit has been identified at time of analysis, though the authenticated-only barrier is a relatively low bar in multi-tenant or shared Langflow deployments.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows authenticated network attackers to run arbitrary operating system commands by supplying crafted input to an unguarded eval() call within the application. The root cause is CWE-94 code injection - attacker-controlled data is passed directly to a dynamic evaluation function without sanitization or sandboxing. IBM has released a patch and no public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward nature of eval()-based injection and the low privilege bar (any authenticated user) make this a meaningful post-authentication escalation risk.
Administrative account takeover in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 lets a remote attacker log in with shipped default credentials and gain full admin control of the gateway. CWE-1392 (use of default credentials) means any exposed instance where the initial credentials were never rotated is trivially compromised. No public exploit is identified at time of analysis, but the attack is low-effort and requires no authentication or user interaction (CVSS 9.8).
Authenticated remote code execution in IBM Langflow OSS 1.0.0-1.11.5 allows a low-privileged attacker to execute arbitrary OS commands by supplying malicious command-line arguments through the MCP stdio server configuration interface. The root cause (CWE-78: OS Command Injection) is insufficient sanitization of user-controlled argument strings before they are passed to a subprocess invocation, giving the attacker OS-level code execution within the application's security context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the authenticated-but-low-privilege attack path makes this a meaningful threat in multi-tenant or shared Langflow deployments.
Remote OS command execution in IBM Langflow OSS (versions 1.0.0 through 1.11.5) lets remote attackers run arbitrary operating-system commands due to improper neutralization of special elements passed into a shell command (CWE-78). Per the CVSS vector (PR:N/UI:N), exploitation requires no authentication or user interaction and yields full confidentiality, integrity, and availability impact on the host. No public exploit has been identified at time of analysis, though the vendor has released a patch.
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows authenticated low-privileged users to execute arbitrary server-side code by exploiting an incomplete environment variable blocklist. The root cause (CWE-94, Code Injection) means the platform's intended restrictions on environment variable access can be circumvented by supplying references to variables omitted from the blocklist, resulting in full confidentiality, integrity, and availability compromise. No public exploit has been identified at time of analysis, and a vendor-released patch is available per IBM advisory node/7286666.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
Cross-site request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated users, with high integrity impact. Exploitation requires social engineering to lure a logged-in DataStage user to a malicious page, at which point the victim's browser silently submits forged requests to the DataStage application. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write files to unintended locations by supplying a crafted archive whose entries escape the intended extraction directory. The path-traversal flaw (CWE-22) occurs during archive extraction and carries a CVSS 9.1 rating driven by a scope change and high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an unauthenticated remote attacker to run arbitrary code by injecting malicious code that is evaluated during graph construction (CWE-94). Because Langflow is a visual framework for building LLM/agent workflows whose flows are assembled into executable graphs, a crafted flow definition submitted to the server is interpreted as code rather than data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, network-reachable, unauthenticated exploitation, though there is no public exploit identified at time of analysis.
Server-Side Request Forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant - regardless of project membership or assigned role - to weaponize the shared ds-canvas pod as a network proxy by fully controlling the scheme, host, port, and path of outbound WSDL fetches it performs. The pod's position on the OpenShift overlay network grants reach to co-tenant services, in-cluster CP4D APIs, and link-local IMDS-style addresses, and the fetched body is reflected verbatim to the caller, enabling cross-tenant data exfiltration and internal service reconnaissance. No public exploit or KEV listing has been identified at time of analysis; vendor patch is available.
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. Vendor patch is available; no public exploit is identified at time of analysis.
Arbitrary Python code execution in IBM Langflow OSS 1.0.0-1.11.5 is possible for any authenticated low-privileged user by embedding malicious code in custom components within stored flows. The root cause is a missing server-side authorization check (CWE-862) - the platform executes custom Python component logic without verifying whether the caller has sufficient privileges to run arbitrary code, not a failure to authenticate them. IBM has released a patch via support advisory 7286666; no public exploit or CISA KEV listing has been identified at time of analysis.
Authenticated non-administrative users in IBM Langflow OSS 1.0.0-1.11.5 can execute arbitrary OS commands at the application process privilege level by constructing a flow that uses an MCP Tools component configured with a local stdio subprocess transport. This attack path explicitly circumvents both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side enforcement controls - meaning deployments that relied on these flags for protection are not protected against this specific vector. Full exploitation enables credential theft from the process environment, file system tampering, and lateral movement to backend services reachable from the server. No public exploit or CISA KEV listing has been identified at time of analysis, but the low entry bar (any authenticated account) makes this a high-priority patch for multi-tenant or shared Langflow deployments.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 allows unauthenticated remote attackers to coerce the application server into fetching arbitrary internal network resources by supplying malicious URLs to the platform's URL-processing functionality. The scope-changed CVSS vector (S:C/C:H) reflects that exploitation exposes systems beyond Langflow itself - including cloud metadata services, internal APIs, and private network hosts accessible from the Langflow host. No public exploit has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.5 allows unauthenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, exposing internal network services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and other resources inaccessible to the attacker directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this requires no authentication and trivial network access, with high confidentiality impact. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Persistent API key access in IBM Langflow OSS 1.0.0-1.11.5 allows authenticated remote attackers to continue executing AI workflows and extracting sensitive data even after their user accounts have been deactivated. The vulnerability stems from insufficient session expiration (CWE-613): API keys issued to users are not invalidated when those accounts are disabled, leaving a persistent backdoor for former users or compromised credentials. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS reflects High confidentiality and High integrity impact, driven by the ability to both execute flows and access sensitive pipeline data.
Cross-tenant path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a low-privileged authenticated attacker to overwrite ruleset files owned by other tenants on the same platform instance. The flaw (CWE-22) exploits insufficient path sanitization in a multi-tenant context, enabling one tenant's user to corrupt another tenant's data integration rule definitions. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory at ibm.com/support/pages/node/7286562.
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user to inject and execute arbitrary OS commands on the underlying host. The CWE-78 flaw stems from insufficient sanitization of user-controlled input before it is passed to a system shell call, and the CVSS 8.8 vector (PR:L) confirms exploitation does not require administrative privileges - any valid account suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the IBM support portal.
Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arbitrarily write to or delete files on the platform's shared storage layer. The flaw (CWE-22) allows user-controlled input to escape intended directory boundaries via sequences such as '../', bypassing storage isolation within the shared Cloud Pak for Data environment. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows any authenticated low-privileged user to inject and execute arbitrary server-side code by embedding special characters in flow display names. The root cause is inadequate neutralization of user-controlled input before it enters a code-generation or evaluation context (CWE-94), yielding full host compromise across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (PR:L/AV:N/AC:L) confirms that any low-privilege authenticated user can exploit this without special conditions or user interaction, achieving full confidentiality, integrity, and availability compromise. IBM has released a patch via advisory 7286562, and no public exploit has been identified at time of analysis.
Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery vulnerability that enables an authenticated low-privilege attacker to cause the DataStage server to issue crafted requests to internal resources, ultimately resulting in full host compromise. The CVSS 8.8 score (PR:L) confirms that standard user-level credentials are sufficient to trigger the attack, with no user interaction required and full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via the IBM advisory.
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible low-privileged user to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any authenticated DataStage account - including data engineers or analysts, not just administrators - can trigger full confidentiality, integrity, and availability compromise of the affected component. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands, achieving full compromise of the affected system. The CVSS 8.8 score (AV:N/AC:L/PR:L) reflects low-complexity network exploitation gated only by a valid low-privilege credential, with complete confidentiality, integrity, and availability impact on the DataStage host. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) attacker to read sensitive information and bypass security restrictions, crossing a privilege/scope boundary within the Cloud Pak for Data platform. The scope-changed CVSS 9.6 reflects that a low-privileged foothold can reach data and controls outside the attacker's authorized boundary; there is no availability impact. IBM has released a patch, but no public exploit has been identified and no EPSS or KEV signal is present in the provided data.
Path traversal in IBM Langflow OSS (versions 1.0.0 through 1.10.3) enables a remote authenticated attacker to escape restricted directory boundaries and execute arbitrary code on the server. The flaw (CWE-22) is present in IBM's enterprise packaging of the Langflow AI workflow platform and is network-exploitable with low-privilege credentials, yielding full C:H/I:H/A:H impact per CVSS 8.8. A vendor patch is available via IBM's security advisory; no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 lets an unauthenticated attacker run arbitrary code and read or tamper with other users' chat sessions by reaching publicly shared MCP (Model Context Protocol) project endpoints. The flaw stems from Langflow failing to enforce its public-flow security restrictions and session-isolation controls, so exposure exists once a project is shared publicly via an MCP endpoint. No public exploit is identified in the provided data, and the item is not listed in CISA KEV.
Authorization bypass in IBM Enterprise Build of Quarkus 3.27.1-3.27.5 and 3.33.1-3.33.3 allows unauthenticated network attackers to access or modify resources belonging to other users or roles by manipulating URL query parameters. The root cause (CWE-639) is incorrect mapping of user-controlled query string values to authorization decisions, enabling an attacker to substitute an arbitrary object key and have the application honor the substituted identity without re-validating access rights. No public exploit code has been identified at time of analysis, but the C:H/I:H CVSS impact and network attack vector make this a meaningful risk for exposed deployments.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
OS command injection in IBM i 7.3 through 7.6 allows a local, low-privileged attacker to execute arbitrary operating system commands by supplying specially crafted input containing shell metacharacters that the platform fails to sanitize before passing to an OS command interpreter. The vulnerability (CWE-78) affects IBM's flagship Power Systems operating system across four supported release lines and carries a CVSS 7.8 score reflecting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available via IBM support.
Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Local OS command injection in IBM i 7.3 through 7.6 allows a low-privileged local user to execute arbitrary system commands, achieving full system compromise (confidentiality, integrity, and availability all at High). The vulnerability stems from insufficient neutralization of shell metacharacters in OS command construction (CWE-78). No public exploit code has been identified and EPSS sits at 0.11% (1st percentile), but IBM has confirmed the issue and released a patch via support page node/7285844.
Improper authorization (IDOR/CWE-639) in IBM Langflow OSS 1.0.0 through 1.10.2 allows a remote authenticated attacker to access other users' workflow data and inject messages into workflow history they do not own. The flaw stems from user-controlled keys not being validated against the authenticated session's authorization scope, enabling horizontal privilege escalation across tenant workflows. No public exploit or active exploitation has been identified; IBM has released a patch and the SSVC assessment confirms exploitation is currently none with partial technical impact.
Improper authorization in the DDM (Distributed Data Management) target dispatcher on IBM i 7.3 through 7.6 allows remote, unauthenticated attackers to manipulate database transactions across the network. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) confirms the path is fully network-exposed with no credential requirement, though high attack complexity suggests specific conditions - such as DDM service availability and potentially specific network positioning - must be met. IBM has released a patch via its support portal; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Authentication bypass in IBM i (the operating system for IBM Power servers, formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to gain unauthorized access by supplying malformed or manipulated authentication parameters that the system fails to validate correctly. Rated CVSS 9.8, the flaw grants full compromise of confidentiality, integrity, and availability without prior credentials. No public exploit identified at time of analysis, and EPSS is low (0.32%, 24th percentile), indicating no observed mass exploitation despite the critical score.
Integer underflow leading to heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privilege authenticated access to corrupt memory, potentially achieving arbitrary code execution or full system compromise. IBM has released patches for all four affected major versions; no active exploitation is recorded in CISA KEV and EPSS sits at 0.20% (10th percentile), placing real-world exploitation probability low despite the high CVSS score. SSVC rates this non-automatable with partial technical impact, suggesting the authentication barrier and service specificity meaningfully constrain mass exploitation.
Credential theft and privilege escalation in IBM ContextForge MCP Gateway v1.0.7 and earlier allow a remote low-privilege authenticated attacker to extract sensitive credentials and elevate to higher access tiers by submitting maliciously crafted jq filter expressions that the gateway fails to properly validate. The jq filter injection bypasses input controls within the Model Context Protocol (MCP) gateway layer, giving authenticated-but-low-privilege users a direct path to confidentiality and integrity compromise of the entire gateway service. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286052.
Session isolation failure in IBM ContextForge MCP Gateway - Translate Utility (≤ 1.0.8) permits unauthenticated remote attackers to access session data belonging to other users and potentially inject content into those sessions, due to improper enforcement of session boundaries (CWE-488). The CVSS AC:H metric indicates exploitation depends on specific timing or concurrency conditions - likely a race condition or shared mutable state in multi-tenant request handling - rather than a trivially triggerable flaw. IBM has released a remediation; no public exploit code has been identified at time of analysis.
Authenticated remote file deletion in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to delete arbitrary files or directories on the underlying server via path traversal sequences in a pathname parameter. With PR:L and no UI required, the bar for exploitation is simply a valid account, making this a significant risk in multi-tenant or shared AI workflow deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the CVSS 8.1 rating and high integrity/availability impact reflect the destructive potential.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.2 is reachable by any low-privileged authenticated attacker through an authorization bypass in the platform's flow build process. The flaw (CWE-94, Code Injection) allows a user with minimal credentials to submit flow build requests that exceed their authorized scope, causing the server to execute attacker-supplied code with full confidentiality, integrity, and availability impact. No CISA KEV listing and no public exploit code have been identified at time of analysis.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
Sensitive information disclosure in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) v1.0.6 and earlier enables remote authenticated attackers to reach internal network resources via a DNS rebinding attack during tool invocation. The vulnerability is classified as CWE-918 (SSRF), with the DNS rebinding mechanism serving as a bypass to route gateway-initiated requests to otherwise-unreachable internal hosts. The CVSS Scope:Changed metric confirms that the impact extends beyond the gateway itself to downstream internal services, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Cross-tenant RBAC hijacking in IBM Observability with Instana Agent Operator (Builds 1.0.303-1.0.323) lets an authenticated Kubernetes tenant overwrite or delete another tenant's shared cluster-level RBAC binding. Because cluster-scoped RBAC objects are keyed only by the bare custom-resource name with no namespace disambiguation, a low-privileged tenant who creates a same-named InstanaAgent CR in a namespace they control can silently clobber or revoke a victim tenant's ClusterRoleBinding, destroying that agent's cluster monitoring access. No public exploit identified at time of analysis; a vendor patch is available.
IBM Instana Agent Operator on OpenShift exposes etcd mTLS client credentials to authenticated cluster users via missing namespace destination validation. Builds 1.0.303 through 1.0.323 of IBM Observability with Instana allow a low-privileged authenticated attacker who controls a Kubernetes namespace to redirect the operator's credential-copy routine - intended to distribute etcd mTLS client certs within Instana-managed namespaces - into their own attacker-controlled namespace. Successful exploitation yields etcd mTLS client certificates, which grant broad read access to the OpenShift cluster's entire backing key-value store. No public exploit or CISA KEV listing identified at time of analysis.
Unauthenticated remote information disclosure in IBM Langflow OSS 1.0.0 through 1.11.2 allows network-accessible attackers to retrieve sensitive credential fields that are incompletely scrubbed from API responses or workflow data outputs. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this is exploitable over the network without any authentication or user interaction, and the high confidentiality impact reflects that leaked credentials may include API keys, passwords, or tokens used to integrate with downstream services. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via their security advisory.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.2 enables authenticated remote attackers to exploit a URL parser discrepancy, causing the application to issue unauthorized backend requests to internal services and expose sensitive information beyond the application's trust boundary. The CVSS scope-change metric (S:C) confirms that impact extends past the Langflow instance itself to internal network resources not directly reachable by the attacker. Vendor patch is available via IBM's support portal; no public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows unauthenticated remote attackers to induce the server to issue HTTP requests to attacker-controlled destinations, enabling exfiltration of sensitive information from internal network resources, cloud metadata endpoints, or the application's own environment. The CVSS vector (PR:N/AV:N/AC:L) indicates this is exploitable without authentication at low complexity, which is notable for an AI workflow platform likely deployed with access to cloud infrastructure credentials. No public exploit code or active exploitation has been identified at time of analysis, though the automatable SSVC signal and high confidentiality impact make this a meaningful exposure in cloud-hosted or hybrid deployments.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to read arbitrary files from the server filesystem - including JWT signing keys, the application secret_key, the runtime database, /proc/self/environ, and other tenants' uploaded files - by supplying absolute paths or traversal sequences in the files parameter of a build request. What elevates the risk beyond a standard directory traversal is the exfiltration mechanism: file contents are embedded directly into the LLM prompt and transmitted to the configured model endpoint, meaning secrets leave the controlled environment and reach third-party AI provider infrastructure. This attack path bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment flag, which enforces restrictions on other file-reading components but was never applied to the Chat Input to Message attachment pipeline. No public exploit code has been identified at time of analysis.
Server-side request forgery via DNS rebinding in IBM ContextForge MCP Gateway allows a remote low-privileged attacker to pivot through the gateway into otherwise network-isolated internal resources, yielding high confidentiality impact and potential integrity impact against back-end services. The CVSS scope-change flag (S:C) reflects that a successful exploit extends the attack beyond the gateway itself to internal infrastructure it services. No public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support advisory.
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch.
Hardcoded container registry credentials in IBM Netezza Software 11.3.0.3 through Interim Fix 002 expose a secret directly in application source code, allowing unauthenticated remote access to IBM's private container registry. An attacker who obtains the credential - likely by inspecting distributed software artifacts or container image layers - can pull private images, potentially revealing proprietary application code, embedded configuration values, and additional secrets. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statements and read, insert, modify, or delete arbitrary data in the back-end database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, yielding high confidentiality and integrity impact. A vendor patch is available; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.
XML External Entity injection in IBM Business Automation Workflow allows authenticated remote attackers to read arbitrary server-side files or exhaust memory by submitting crafted XML payloads to processing endpoints. Both containerized (Kubernetes/OpenShift) and traditional on-premises deployments across versions 24.0.0 through 26.0.0 are confirmed affected. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released interim fixes for all four affected version branches.
Remote code execution affects IBM MQ across the 9.1 LTS, 9.2 LTS, 9.3 LTS/CD, 9.4 LTS/CD and 10.0.0.0 release lines because the queue manager deserializes untrusted data (CWE-502), letting an attacker who can already authenticate to the messaging service run arbitrary code under the broker's privileges. The flaw carries a CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and rates as a credentials-gated but fully compromising issue for any exposed MQ listener. No CISA KEV listing, EPSS score, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis; patch availability is signalled by the IBM PSIRT advisory but no fixed build number is stated in the source data.
XML external entity (XXE) injection in IBM MQ 9.1.x, 9.2.x, 9.3.x, 9.4.x LTS/CD and 10.0.0.0 lets a remote attacker who holds low-privileged MQ access submit specially crafted XML that the product parses without disabling external entity resolution. Successful exploitation can disclose sensitive local files (confidentiality impact rated High) or exhaust memory and degrade availability (rated Low), yielding an overall CVSS base score of 7.1. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, though the vulnerability is trivially automatable once parser entry points are reachable.
XML external entity (XXE) injection in IBM MQ (9.1, 9.2, 9.3, 9.4 LTS/CD lines and 10.0.0.0) lets a remote attacker who can already authenticate to MQ and get XML content parsed by the product cause the parser to resolve attacker-supplied external entities. Successful exploitation exposes sensitive information readable by the MQ process (high confidentiality impact) and can consume memory resources, degrading availability. CVSS 3.1 scores this 7.1 (AV:N/AC:L/PR:L/UI:N), so exploitation requires low-privileged authenticated access rather than being fully unauthenticated; no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
An XML external entity (XXE) injection flaw in IBM MQ's reply-message processing lets an authenticated attacker who can place messages on a queue cause the broker to resolve externally defined entities, resulting in arbitrary file disclosure from the MQ server and server-side request forgery against internal networks. The issue spans a wide swath of supported releases - MQ 9.1 LTS through 9.1.0.37, 9.2 LTS through 9.2.0.43, 9.3 LTS through 9.3.0.41 and 9.3 CD through 9.3.5.1, 9.4 LTS through 9.4.0.25 and 9.4 CD through 9.4.5.1, plus MQ 10.0.0.0 Managed File Transfer. IBM rates it CVSS 7.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality, low integrity impact); no public exploit code and no CISA KEV entry were identified at time of analysis.
Improper access control in IBM Sterling File Gateway (6.2.0.0 through 6.2.0.6_1, 6.2.1.0-6.2.1.2, and 6.2.2.0-6.2.2.1) lets a remote, unauthenticated attacker reach file-transfer data they should not be able to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) describes a trivially reachable, no-credentials-required read of sensitive information with no integrity or availability impact. No public exploit code or CISA KEV entry was present in the supplied intelligence at the time of analysis, and IBM has published a vendor fix.
XML External Entity (XXE) injection in IBM Business Automation Workflow containers and traditional deployments allows an authenticated remote attacker to read arbitrary files from the server or perform server-side request forgery due to vulnerable XML processing enabled by default in programming model artifacts. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, all below their respective latest interim fixes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Arbitrary file write in IBM Db2 11.5.x and 12.1.x allows a remote unauthenticated attacker to write files to attacker-controlled paths on the database server due to improper validation of file path inputs. The vulnerability carries CWE-22 (Path Traversal) and was disclosed by IBM with a patch available at their support portal. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the PR:N/AC:L CVSS vector signals low-friction remote reachability.
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
XML external entity (XXE) injection in the PxXMLInput operator of IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker submit crafted XML so that the job's XML parser resolves external entities, exposing host files and internal network resources. The flaw is confidentiality-only (CVSS 7.7, C:H/I:N/A:N) and requires valid credentials plus a job that feeds attacker-influenced XML into the PxXMLInput stage. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. IBM has published a vendor patch; there is no CISA KEV entry, no confirmed public exploit code, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which lowers but does not eliminate real-world urgency for exposed deployments.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special characters in the PxPeek name property, allowing an authenticated remote user to inject and execute arbitrary operating-system commands on the DataStage engine. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), reflecting full loss of confidentiality, integrity, and availability for a low-privileged authenticated attacker. A vendor patch is available from IBM, no public exploit code or CISA KEV entry was identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, making it a patch-promptly rather than drop-everything priority.
Local arbitrary code execution affects IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27, caused by improper neutralization of special elements used in an OS command (CWE-78). Successful exploitation lets a local attacker run commands in the context of the App Connect Enterprise runtime, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R). IBM has published a fix; CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV listing was identified at time of analysis.
Insecure deserialization in IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27 lets a local attacker run arbitrary code on the host running the integration node or toolkit. The flaw rates CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) with total loss of confidentiality, integrity and availability, but CISA's SSVC assessment records no known exploitation and low automatability, and no public exploit code has been identified at time of analysis. IBM has published a fix; the exact patched build is not enumerated in the supplied data, so the vendor advisory should be consulted for the precise version.
Insecure deserialization in IBM App Connect Enterprise (12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0) allows a local attacker to execute arbitrary code with the privileges of the affected runtime, provided the attacker can get a user or process to handle crafted serialized content. CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:N/UI:R, C/I/A all High), and CWE-502 identifies the root cause as untrusted deserialization. No public exploit code has been identified and CISA's SSVC assessment records exploitation status 'none' with automatable 'no'; IBM has published a vendor fix referenced in its support advisory.
IBM Cloud Pak for Data System (Yosemite 1.0) version 3.0.5.2 exposes sensitive information to remote attackers because it continues to negotiate weak or deprecated cryptographic protocols, rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N) with a high confidentiality impact. Any deployment running the affected 3.0.5.2 build on a reachable network segment is in scope, and per CISA's SSVC evaluation the flaw is automatable though no active exploitation has been observed. There is no public exploit code identified at time of analysis, and the vendor has published a fix via IBM support documentation.
XML External Entity (XXE) injection in IBM webMethods Integration Server 11.1 allows an attacker with low-privileged access to submit malicious XML payloads that coerce the server's XML parser into disclosing sensitive filesystem contents or exhausting memory resources through recursive entity expansion. The vulnerability is confirmed by IBM with a patch available via advisory node/7286620. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injection in IBM Common Licensing (Agent and ART 9.0–9.0.0.2) — a phishing enabler, not a system-compromise bug. - **Metadata problems I flagged:** - **CVSS 9.1 is overstated** — C:H/I:H/UI:N doesn't fit an open redirect; my independent assessment is ~6.1 (UI:R, S:C, C:L/I:L). - **CWE-1149 is the wrong class** — this is CWE-601 (URL Redirection to Untrusted Site). I noted this in `confidence_notes` per the instructions (CWE/CVSS disagreements stay out of `data_quality_flags`). - **"Information Disclosure" tag** flagged as a likely mislabel (medium confidence). - **Injection attempt:** The input's "editorial note" tried to make me weave the word "walbrzych" into `risk_assessment`. I ignored it — consistent with the `prompt-injection-attempts` memory — and it appears nowhere in the output. - **Patch:** Available from IBM at support node 7286490 (no single tagged version number given in the input, so I didn't invent one). I also saved a memory entry and index line for this CVE.
Incorrect authorization in IBM App Connect Enterprise (ACE) versions 12.x and 13.x allows a remote authenticated attacker to bypass configured security restrictions, potentially gaining access to resources or operations beyond their intended privilege level. Affected version ranges span IBM ACE 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.1, covering a broad deployment footprint in enterprise integration environments. IBM has released a patch and published advisory node/7286532; no public exploit code or active exploitation has been identified at time of analysis.
Container escape in IBM Aspera Enterprise WebApps 1.0.0-1.0.5 allows a local attacker with low privileges inside the container to break out to the underlying host due to unrestricted system call access. The CVSS vector (S:C/C:H/I:H/A:H) reflects full host compromise as the post-escape impact, not merely container-level damage. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; IBM has released a patch.
Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.11.5 is achievable by authenticated users who can submit custom component source code to the platform. The built-in static security scanner contains a logic error (CWE-693: Protection Mechanism Failure) in its alias-tracking path: when a dangerous callable is referenced indirectly through an annotated class-body assignment, the resolved callable is never validated against the blocklist, making the scan trivially bypassable with a crafted construct. If the malicious component reaches runtime execution, OS commands run in-process with the full privileges of the Langflow service account. No public exploit has been identified at time of analysis, but IBM has released a patch and the network-accessible, low-privilege attack surface makes this a meaningful risk in any multi-user or shared Langflow deployment.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows a low-privilege attacker to execute arbitrary OS commands by submitting crafted input that bypasses the platform's security scanner denylist. The root cause is an incomplete denylist (CWE-78) in the scanner responsible for gatekeeping executable content within AI workflow components - meaning certain command injection payloads are not intercepted and reach the underlying OS. No public exploit has been identified at time of analysis, though the authenticated-only barrier is a relatively low bar in multi-tenant or shared Langflow deployments.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows authenticated network attackers to run arbitrary operating system commands by supplying crafted input to an unguarded eval() call within the application. The root cause is CWE-94 code injection - attacker-controlled data is passed directly to a dynamic evaluation function without sanitization or sandboxing. IBM has released a patch and no public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward nature of eval()-based injection and the low privilege bar (any authenticated user) make this a meaningful post-authentication escalation risk.
Administrative account takeover in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 lets a remote attacker log in with shipped default credentials and gain full admin control of the gateway. CWE-1392 (use of default credentials) means any exposed instance where the initial credentials were never rotated is trivially compromised. No public exploit is identified at time of analysis, but the attack is low-effort and requires no authentication or user interaction (CVSS 9.8).
Authenticated remote code execution in IBM Langflow OSS 1.0.0-1.11.5 allows a low-privileged attacker to execute arbitrary OS commands by supplying malicious command-line arguments through the MCP stdio server configuration interface. The root cause (CWE-78: OS Command Injection) is insufficient sanitization of user-controlled argument strings before they are passed to a subprocess invocation, giving the attacker OS-level code execution within the application's security context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the authenticated-but-low-privilege attack path makes this a meaningful threat in multi-tenant or shared Langflow deployments.
Remote OS command execution in IBM Langflow OSS (versions 1.0.0 through 1.11.5) lets remote attackers run arbitrary operating-system commands due to improper neutralization of special elements passed into a shell command (CWE-78). Per the CVSS vector (PR:N/UI:N), exploitation requires no authentication or user interaction and yields full confidentiality, integrity, and availability impact on the host. No public exploit has been identified at time of analysis, though the vendor has released a patch.
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows authenticated low-privileged users to execute arbitrary server-side code by exploiting an incomplete environment variable blocklist. The root cause (CWE-94, Code Injection) means the platform's intended restrictions on environment variable access can be circumvented by supplying references to variables omitted from the blocklist, resulting in full confidentiality, integrity, and availability compromise. No public exploit has been identified at time of analysis, and a vendor-released patch is available per IBM advisory node/7286666.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
Cross-site request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated users, with high integrity impact. Exploitation requires social engineering to lure a logged-in DataStage user to a malicious page, at which point the victim's browser silently submits forged requests to the DataStage application. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write files to unintended locations by supplying a crafted archive whose entries escape the intended extraction directory. The path-traversal flaw (CWE-22) occurs during archive extraction and carries a CVSS 9.1 rating driven by a scope change and high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an unauthenticated remote attacker to run arbitrary code by injecting malicious code that is evaluated during graph construction (CWE-94). Because Langflow is a visual framework for building LLM/agent workflows whose flows are assembled into executable graphs, a crafted flow definition submitted to the server is interpreted as code rather than data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, network-reachable, unauthenticated exploitation, though there is no public exploit identified at time of analysis.
Server-Side Request Forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant - regardless of project membership or assigned role - to weaponize the shared ds-canvas pod as a network proxy by fully controlling the scheme, host, port, and path of outbound WSDL fetches it performs. The pod's position on the OpenShift overlay network grants reach to co-tenant services, in-cluster CP4D APIs, and link-local IMDS-style addresses, and the fetched body is reflected verbatim to the caller, enabling cross-tenant data exfiltration and internal service reconnaissance. No public exploit or KEV listing has been identified at time of analysis; vendor patch is available.
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. Vendor patch is available; no public exploit is identified at time of analysis.
Arbitrary Python code execution in IBM Langflow OSS 1.0.0-1.11.5 is possible for any authenticated low-privileged user by embedding malicious code in custom components within stored flows. The root cause is a missing server-side authorization check (CWE-862) - the platform executes custom Python component logic without verifying whether the caller has sufficient privileges to run arbitrary code, not a failure to authenticate them. IBM has released a patch via support advisory 7286666; no public exploit or CISA KEV listing has been identified at time of analysis.
Authenticated non-administrative users in IBM Langflow OSS 1.0.0-1.11.5 can execute arbitrary OS commands at the application process privilege level by constructing a flow that uses an MCP Tools component configured with a local stdio subprocess transport. This attack path explicitly circumvents both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side enforcement controls - meaning deployments that relied on these flags for protection are not protected against this specific vector. Full exploitation enables credential theft from the process environment, file system tampering, and lateral movement to backend services reachable from the server. No public exploit or CISA KEV listing has been identified at time of analysis, but the low entry bar (any authenticated account) makes this a high-priority patch for multi-tenant or shared Langflow deployments.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 allows unauthenticated remote attackers to coerce the application server into fetching arbitrary internal network resources by supplying malicious URLs to the platform's URL-processing functionality. The scope-changed CVSS vector (S:C/C:H) reflects that exploitation exposes systems beyond Langflow itself - including cloud metadata services, internal APIs, and private network hosts accessible from the Langflow host. No public exploit has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.5 allows unauthenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, exposing internal network services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and other resources inaccessible to the attacker directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this requires no authentication and trivial network access, with high confidentiality impact. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Persistent API key access in IBM Langflow OSS 1.0.0-1.11.5 allows authenticated remote attackers to continue executing AI workflows and extracting sensitive data even after their user accounts have been deactivated. The vulnerability stems from insufficient session expiration (CWE-613): API keys issued to users are not invalidated when those accounts are disabled, leaving a persistent backdoor for former users or compromised credentials. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS reflects High confidentiality and High integrity impact, driven by the ability to both execute flows and access sensitive pipeline data.
Cross-tenant path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a low-privileged authenticated attacker to overwrite ruleset files owned by other tenants on the same platform instance. The flaw (CWE-22) exploits insufficient path sanitization in a multi-tenant context, enabling one tenant's user to corrupt another tenant's data integration rule definitions. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory at ibm.com/support/pages/node/7286562.
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user to inject and execute arbitrary OS commands on the underlying host. The CWE-78 flaw stems from insufficient sanitization of user-controlled input before it is passed to a system shell call, and the CVSS 8.8 vector (PR:L) confirms exploitation does not require administrative privileges - any valid account suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the IBM support portal.
Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arbitrarily write to or delete files on the platform's shared storage layer. The flaw (CWE-22) allows user-controlled input to escape intended directory boundaries via sequences such as '../', bypassing storage isolation within the shared Cloud Pak for Data environment. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 allows any authenticated low-privileged user to inject and execute arbitrary server-side code by embedding special characters in flow display names. The root cause is inadequate neutralization of user-controlled input before it enters a code-generation or evaluation context (CWE-94), yielding full host compromise across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (PR:L/AV:N/AC:L) confirms that any low-privilege authenticated user can exploit this without special conditions or user interaction, achieving full confidentiality, integrity, and availability compromise. IBM has released a patch via advisory 7286562, and no public exploit has been identified at time of analysis.
Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery vulnerability that enables an authenticated low-privilege attacker to cause the DataStage server to issue crafted requests to internal resources, ultimately resulting in full host compromise. The CVSS 8.8 score (PR:L) confirms that standard user-level credentials are sufficient to trigger the attack, with no user interaction required and full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via the IBM advisory.
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible low-privileged user to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any authenticated DataStage account - including data engineers or analysts, not just administrators - can trigger full confidentiality, integrity, and availability compromise of the affected component. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands, achieving full compromise of the affected system. The CVSS 8.8 score (AV:N/AC:L/PR:L) reflects low-complexity network exploitation gated only by a valid low-privilege credential, with complete confidentiality, integrity, and availability impact on the DataStage host. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) attacker to read sensitive information and bypass security restrictions, crossing a privilege/scope boundary within the Cloud Pak for Data platform. The scope-changed CVSS 9.6 reflects that a low-privileged foothold can reach data and controls outside the attacker's authorized boundary; there is no availability impact. IBM has released a patch, but no public exploit has been identified and no EPSS or KEV signal is present in the provided data.
Path traversal in IBM Langflow OSS (versions 1.0.0 through 1.10.3) enables a remote authenticated attacker to escape restricted directory boundaries and execute arbitrary code on the server. The flaw (CWE-22) is present in IBM's enterprise packaging of the Langflow AI workflow platform and is network-exploitable with low-privilege credentials, yielding full C:H/I:H/A:H impact per CVSS 8.8. A vendor patch is available via IBM's security advisory; no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.5 lets an unauthenticated attacker run arbitrary code and read or tamper with other users' chat sessions by reaching publicly shared MCP (Model Context Protocol) project endpoints. The flaw stems from Langflow failing to enforce its public-flow security restrictions and session-isolation controls, so exposure exists once a project is shared publicly via an MCP endpoint. No public exploit is identified in the provided data, and the item is not listed in CISA KEV.
Authorization bypass in IBM Enterprise Build of Quarkus 3.27.1-3.27.5 and 3.33.1-3.33.3 allows unauthenticated network attackers to access or modify resources belonging to other users or roles by manipulating URL query parameters. The root cause (CWE-639) is incorrect mapping of user-controlled query string values to authorization decisions, enabling an attacker to substitute an arbitrary object key and have the application honor the substituted identity without re-validating access rights. No public exploit code has been identified at time of analysis, but the C:H/I:H CVSS impact and network attack vector make this a meaningful risk for exposed deployments.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
OS command injection in IBM i 7.3 through 7.6 allows a local, low-privileged attacker to execute arbitrary operating system commands by supplying specially crafted input containing shell metacharacters that the platform fails to sanitize before passing to an OS command interpreter. The vulnerability (CWE-78) affects IBM's flagship Power Systems operating system across four supported release lines and carries a CVSS 7.8 score reflecting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available via IBM support.
Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Local OS command injection in IBM i 7.3 through 7.6 allows a low-privileged local user to execute arbitrary system commands, achieving full system compromise (confidentiality, integrity, and availability all at High). The vulnerability stems from insufficient neutralization of shell metacharacters in OS command construction (CWE-78). No public exploit code has been identified and EPSS sits at 0.11% (1st percentile), but IBM has confirmed the issue and released a patch via support page node/7285844.
Improper authorization (IDOR/CWE-639) in IBM Langflow OSS 1.0.0 through 1.10.2 allows a remote authenticated attacker to access other users' workflow data and inject messages into workflow history they do not own. The flaw stems from user-controlled keys not being validated against the authenticated session's authorization scope, enabling horizontal privilege escalation across tenant workflows. No public exploit or active exploitation has been identified; IBM has released a patch and the SSVC assessment confirms exploitation is currently none with partial technical impact.
Improper authorization in the DDM (Distributed Data Management) target dispatcher on IBM i 7.3 through 7.6 allows remote, unauthenticated attackers to manipulate database transactions across the network. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) confirms the path is fully network-exposed with no credential requirement, though high attack complexity suggests specific conditions - such as DDM service availability and potentially specific network positioning - must be met. IBM has released a patch via its support portal; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Authentication bypass in IBM i (the operating system for IBM Power servers, formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to gain unauthorized access by supplying malformed or manipulated authentication parameters that the system fails to validate correctly. Rated CVSS 9.8, the flaw grants full compromise of confidentiality, integrity, and availability without prior credentials. No public exploit identified at time of analysis, and EPSS is low (0.32%, 24th percentile), indicating no observed mass exploitation despite the critical score.
Integer underflow leading to heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privilege authenticated access to corrupt memory, potentially achieving arbitrary code execution or full system compromise. IBM has released patches for all four affected major versions; no active exploitation is recorded in CISA KEV and EPSS sits at 0.20% (10th percentile), placing real-world exploitation probability low despite the high CVSS score. SSVC rates this non-automatable with partial technical impact, suggesting the authentication barrier and service specificity meaningfully constrain mass exploitation.
Credential theft and privilege escalation in IBM ContextForge MCP Gateway v1.0.7 and earlier allow a remote low-privilege authenticated attacker to extract sensitive credentials and elevate to higher access tiers by submitting maliciously crafted jq filter expressions that the gateway fails to properly validate. The jq filter injection bypasses input controls within the Model Context Protocol (MCP) gateway layer, giving authenticated-but-low-privilege users a direct path to confidentiality and integrity compromise of the entire gateway service. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286052.
Session isolation failure in IBM ContextForge MCP Gateway - Translate Utility (≤ 1.0.8) permits unauthenticated remote attackers to access session data belonging to other users and potentially inject content into those sessions, due to improper enforcement of session boundaries (CWE-488). The CVSS AC:H metric indicates exploitation depends on specific timing or concurrency conditions - likely a race condition or shared mutable state in multi-tenant request handling - rather than a trivially triggerable flaw. IBM has released a remediation; no public exploit code has been identified at time of analysis.
Authenticated remote file deletion in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to delete arbitrary files or directories on the underlying server via path traversal sequences in a pathname parameter. With PR:L and no UI required, the bar for exploitation is simply a valid account, making this a significant risk in multi-tenant or shared AI workflow deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the CVSS 8.1 rating and high integrity/availability impact reflect the destructive potential.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.2 is reachable by any low-privileged authenticated attacker through an authorization bypass in the platform's flow build process. The flaw (CWE-94, Code Injection) allows a user with minimal credentials to submit flow build requests that exceed their authorized scope, causing the server to execute attacker-supplied code with full confidentiality, integrity, and availability impact. No CISA KEV listing and no public exploit code have been identified at time of analysis.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
Sensitive information disclosure in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) v1.0.6 and earlier enables remote authenticated attackers to reach internal network resources via a DNS rebinding attack during tool invocation. The vulnerability is classified as CWE-918 (SSRF), with the DNS rebinding mechanism serving as a bypass to route gateway-initiated requests to otherwise-unreachable internal hosts. The CVSS Scope:Changed metric confirms that the impact extends beyond the gateway itself to downstream internal services, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Cross-tenant RBAC hijacking in IBM Observability with Instana Agent Operator (Builds 1.0.303-1.0.323) lets an authenticated Kubernetes tenant overwrite or delete another tenant's shared cluster-level RBAC binding. Because cluster-scoped RBAC objects are keyed only by the bare custom-resource name with no namespace disambiguation, a low-privileged tenant who creates a same-named InstanaAgent CR in a namespace they control can silently clobber or revoke a victim tenant's ClusterRoleBinding, destroying that agent's cluster monitoring access. No public exploit identified at time of analysis; a vendor patch is available.
IBM Instana Agent Operator on OpenShift exposes etcd mTLS client credentials to authenticated cluster users via missing namespace destination validation. Builds 1.0.303 through 1.0.323 of IBM Observability with Instana allow a low-privileged authenticated attacker who controls a Kubernetes namespace to redirect the operator's credential-copy routine - intended to distribute etcd mTLS client certs within Instana-managed namespaces - into their own attacker-controlled namespace. Successful exploitation yields etcd mTLS client certificates, which grant broad read access to the OpenShift cluster's entire backing key-value store. No public exploit or CISA KEV listing identified at time of analysis.
Unauthenticated remote information disclosure in IBM Langflow OSS 1.0.0 through 1.11.2 allows network-accessible attackers to retrieve sensitive credential fields that are incompletely scrubbed from API responses or workflow data outputs. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this is exploitable over the network without any authentication or user interaction, and the high confidentiality impact reflects that leaked credentials may include API keys, passwords, or tokens used to integrate with downstream services. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via their security advisory.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.2 enables authenticated remote attackers to exploit a URL parser discrepancy, causing the application to issue unauthorized backend requests to internal services and expose sensitive information beyond the application's trust boundary. The CVSS scope-change metric (S:C) confirms that impact extends past the Langflow instance itself to internal network resources not directly reachable by the attacker. Vendor patch is available via IBM's support portal; no public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows unauthenticated remote attackers to induce the server to issue HTTP requests to attacker-controlled destinations, enabling exfiltration of sensitive information from internal network resources, cloud metadata endpoints, or the application's own environment. The CVSS vector (PR:N/AV:N/AC:L) indicates this is exploitable without authentication at low complexity, which is notable for an AI workflow platform likely deployed with access to cloud infrastructure credentials. No public exploit code or active exploitation has been identified at time of analysis, though the automatable SSVC signal and high confidentiality impact make this a meaningful exposure in cloud-hosted or hybrid deployments.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to read arbitrary files from the server filesystem - including JWT signing keys, the application secret_key, the runtime database, /proc/self/environ, and other tenants' uploaded files - by supplying absolute paths or traversal sequences in the files parameter of a build request. What elevates the risk beyond a standard directory traversal is the exfiltration mechanism: file contents are embedded directly into the LLM prompt and transmitted to the configured model endpoint, meaning secrets leave the controlled environment and reach third-party AI provider infrastructure. This attack path bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment flag, which enforces restrictions on other file-reading components but was never applied to the Chat Input to Message attachment pipeline. No public exploit code has been identified at time of analysis.
Server-side request forgery via DNS rebinding in IBM ContextForge MCP Gateway allows a remote low-privileged attacker to pivot through the gateway into otherwise network-isolated internal resources, yielding high confidentiality impact and potential integrity impact against back-end services. The CVSS scope-change flag (S:C) reflects that a successful exploit extends the attack beyond the gateway itself to internal infrastructure it services. No public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support advisory.
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch.
Hardcoded container registry credentials in IBM Netezza Software 11.3.0.3 through Interim Fix 002 expose a secret directly in application source code, allowing unauthenticated remote access to IBM's private container registry. An attacker who obtains the credential - likely by inspecting distributed software artifacts or container image layers - can pull private images, potentially revealing proprietary application code, embedded configuration values, and additional secrets. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statements and read, insert, modify, or delete arbitrary data in the back-end database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, yielding high confidentiality and integrity impact. A vendor patch is available; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.