IBM
Monthly
Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Transfer Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1) through a heap-based buffer overflow in the asperahttpd component. An unauthenticated network attacker can corrupt memory to crash the service (denial of service) and, in the worst case, hijack execution flow to run arbitrary code or bypass authentication. There is no public exploit identified at time of analysis and SSVC lists exploitation as none, but the CVSS 9.8 rating and 'Automatable: yes' assessment mark this as a high-priority patching target.
Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 through 1.5.19 allows remote attackers to access and modify protected resources without valid credentials, scoring CVSS 9.1 critical. The flaw exposes confidential file transfer data and permits unauthorized modification of integrity-protected assets across all affected releases. No public exploit identified at time of analysis, and EPSS predicts only a 0.02% near-term exploitation probability despite the high severity rating.
Uncontrolled resource consumption in IBM Langflow OSS 1.0.0 through 1.9.0 lets remote attackers exhaust server resources and cause a denial of service against the Langflow service. The CVSS vector (AV:N/AC:L/PR:N/UI:N, availability-only impact rated 7.5) shows exploitation needs network reachability to the Langflow instance but no authentication and no user interaction; instances bound to localhost or shielded by an authenticated proxy or rate limiting carry much lower realistic exposure. No public exploit has been identified at time of analysis, CISA SSVC records no exploitation activity and classifies the flaw as not automatable, and EPSS is low at 0.04% (12th percentile), so overall risk is moderate rather than urgent.
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.1 lets unauthenticated network attackers run arbitrary code by abusing how the platform handles symbolic links while unpacking uploaded archives. Because extraction does not properly validate symlink targets, a crafted archive can write files outside the intended directory and ultimately achieve code execution on the host. The flaw carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is reachable without authentication or user interaction, though no public exploit identified at time of analysis.
Authentication can be bypassed on IBM Operations Analytics - Log Analysis deployments that still carry the default passwords created during the manufacturing/installation process, giving an attacker access to the installation instead of being challenged at login. Per IBM's published vector the attacker needs local access to the host and low-level existing privileges (AV:L/PR:L), which materially limits reach; the sources do not confirm whether the affected login interface is network-exposed, and our own assessment scores the reachability as network/unauthenticated in the worst case. Technical impact is total if the default credentials are unrotated, but no public exploit has been identified at time of analysis, EPSS is 0.02% (5th percentile), and SSVC records exploitation as none and automatable as no, so this reads as serious-but-not-urgent and is tracked for remediation this week.
Authorization bypass in IBM Db2 12.1.0 through 12.1.4 allows remote, unauthenticated attackers to manipulate data written to a remote object storage path by submitting a specially crafted query, an integrity-only impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Exposure is conditional rather than universal: only Db2 instances configured to integrate with remote object storage expose the vulnerable code path, and there is no public exploit identified at time of analysis (EPSS 0.02%, 7th percentile; CISA SSVC exploitation: none, Automatable: no). Because the flaw yields no confidentiality or availability loss and requires a specific deployment configuration, this is a moderate-priority issue rather than an urgent one despite its High CVSS rating.
Memory exhaustion in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 lets a user who can submit crafted SQL against MDC (multi-dimensional clustering) tables drive the database engine out of memory, degrading or halting availability with no confidentiality or integrity impact. The flaw is only reachable where the deployment actually uses MDC tables and where the triggering queries can be submitted; note that while the published CVSS vector lists PR:N, the assessed vector is PR:L, reflecting that a valid database connection and credentials are realistically required. Exploitation is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), EPSS is only 0.04% (12th percentile), and no public exploit code has been identified at time of analysis - every signal points to a moderate, low-urgency availability issue rather than a top priority.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 allows a user who can submit SQL to exhaust the statement heap with a specially crafted query while the engine is running with a small statement-heap configuration, degrading or halting availability for all sessions on the instance. This is a moderate-priority availability issue, not an urgent one: no public exploit was identified at time of analysis, EPSS is 0.01% (2nd percentile), CISA SSVC records an exploitation value of none with automatable set to no, and only availability is impacted (no confidentiality or integrity loss). The published NVD vector scores PR:N, but our assessment treats realistic exploitation as gated by at least a low-privilege database session (PR:L), and authentication requirements are not fully confirmed from available data and should be verified with IBM.
Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded secret - a password or cryptographic key - that the product uses for inbound authentication, outbound communication, or encryption of internal data. Because the credential is the same across every deployment, an attacker who already holds low-level access (CVSS PR:L) can leverage it to gain full confidentiality, integrity, and availability impact (C:H/I:H/A:H) over the network. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Memory-resource exhaustion in IBM WebSphere Application Server - traditional 9.0 and 8.5, plus WebSphere Application Server Liberty 19.0.0.7 through 26.0.0.5 - allows a remote, unauthenticated attacker to deny service by sending a specially crafted request (CWE-400, CVSS 7.5, impact confined to Availability:High with no confidentiality or integrity effect). Per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to an affected HTTP/application endpoint, with no authentication, user interaction, or non-default configuration identified, so default deployments appear reachable. Risk is tempered by the signals: no public exploit code and no confirmed active exploitation were identified (not in CISA KEV), EPSS is very low at 0.04% (14th percentile), and CISA SSVC rates exploitation as none with the attack assessed as not automatable, indicating the attacker must hand-craft a specific request rather than mass-scan.
Local privilege escalation in IBM Netezza Performance Server Replication Services (versions 3.0.2.0 through 3.0.5.0) allows an already-authenticated, low-privileged user on the appliance to gain full root control. By abusing the over-privileged Replication Services component the attacker can execute root-level commands, spawn a root shell, reset the root password, alter or delete system-wide files, and plant persistent backdoors, resulting in complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and no EPSS score was supplied in the source data, so the issue currently reflects vendor-reported risk rather than observed exploitation.
Directory traversal in IBM InfoSphere Optim Test Data Fabrication (versions 1.0.0 through 1.0.2.7) lets a remote, unauthenticated attacker read arbitrary files from the host by sending a crafted URL containing '../' sequences. The flaw is purely an information-disclosure issue - confidentiality is impacted with no integrity or availability effect - and CVSS rates it 7.5 (High). There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation status as none, though it flags the issue as automatable.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 can be triggered by a specially crafted query when the autonomous transactions feature is enabled, allowing an attacker to exhaust resources and take the database instance down. Exposure is materially limited to deployments that have enabled autonomous transactions and to callers able to submit queries; authentication requirements are not fully confirmed from the available data, and the PR:N rating in the published vector should be verified against IBM's advisory. No public exploit code or active exploitation is identified, EPSS is 0.04% (12th percentile), CISA SSVC records exploitation as none, and the vuln.today priority label is this_week.
Authorization bypass in IBM Engineering Lifecycle Management (ELM) 7.0.3, 7.1.0, and 7.2.0 allows unauthenticated remote attackers to modify server property files and gain unauthorized access to the application. The flaw carries a critical CVSS 9.8 score with full confidentiality, integrity, and availability impact, and IBM has released Interim Fixes addressing it. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.03%, 10th percentile).
XML External Entity (XXE) injection in IBM Engineering Lifecycle Management (ELM) 7.0.3, 7.1.0, and 7.2.0 allows authenticated attackers to disclose sensitive information or exhaust memory resources by submitting crafted XML data to the application. The flaw carries a CVSS 7.1 (High) rating with low attack complexity over the network, but EPSS is only 0.02% (5th percentile) and there is no public exploit identified at time of analysis. SSVC classifies exploitation as 'none' with partial technical impact, indicating low immediate urgency despite the vendor-released patch.
Remote code execution in IBM Engineering Lifecycle Management (ELM) versions 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 through Interim Fix 001 allows an attacker with administrative privileges to execute arbitrary code via an exposed method that is not properly restricted (CWE-749). At time of analysis there is no public exploit identified and EPSS is very low (0.01%), but the SSVC technical impact is rated total, making this a high-impact post-authentication issue against ELM administrators. IBM has published a patch advisory and CVSS is 7.2 (AV:N/AC:L/PR:H/UI:N/C:H/I:H/A:H).
Remote code execution and denial of service in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 stem from improper input validation (CWE-444 HTTP Request Smuggling). Unauthenticated network attackers can send crafted requests that desynchronize the plug-in's request parsing, potentially achieving full compromise of the application tier. No public exploit identified at time of analysis, and EPSS remains low (0.06%), but the vendor confirms a patch and CISA SSVC rates the technical impact as total with automatable exploitation.
Remote code execution in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 allows unauthenticated network attackers to execute arbitrary code via a specially crafted HTTP request. The CVSS 9.8 rating reflects complete confidentiality, integrity, and availability impact with no authentication or user interaction required, though EPSS scores it at only 0.20% probability and CISA SSVC reports no current exploitation. No public exploit has been identified at time of analysis, but IBM has released a patch.
HTTP request smuggling in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 allows remote unauthenticated attackers to send specially crafted requests that desynchronize front-end and back-end HTTP parsing. Successful exploitation enables cache poisoning, security control bypass, and limited disclosure or modification of data passing through the plug-in, with a CVSS 7.5 reflecting a Changed scope and high confidentiality impact. There is no public exploit identified at time of analysis, EPSS is low at 0.05% (15th percentile), and CISA SSVC marks exploitation status as none.
Invalid pointer dereference in IBM HTTP Server 8.5 and 9.0 allows an authenticated privileged user on the Administration Server to expose sensitive information or trigger a denial-of-service condition. The flaw requires adjacent network access and existing low-level privileges, and no public exploit identified at time of analysis. EPSS exploitation probability is negligible (0.01%) and CISA SSVC indicates no observed exploitation.
Heap-based buffer overflow in IBM HTTP Server 8.5 and 9.0 allows an attacker already authenticated to the Administration Server to execute arbitrary code or crash the service. The flaw requires adjacent network access and existing low-level privileges, and no public exploit identified at time of analysis despite the high CVSS 8.0 rating. EPSS probability is negligible (0.01%) and SSVC marks exploitation as 'none,' indicating the issue is currently a patch-and-move-on item rather than an emergency.
Remote code execution and denial of service affect IBM HTTP Server 8.5 and 9.0 when deployed with TLS mutual (client certificate) authentication enabled. The flaw is a code injection weakness (CWE-94) that a network-based attacker can leverage to fully compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.24%, 47th percentile), indicating no observed weaponization yet despite the maximal 9.8 CVSS.
Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote unauthenticated attackers to crash or degrade the service when the optional mod_mem_cache module is loaded. The flaw carries a CVSS 7.5 (availability-only impact) and has no public exploit identified at time of analysis, though the SSVC framework rates exploitation as automatable. EPSS probability is very low (0.01%, 3rd percentile), suggesting limited near-term exploitation interest.
Denial of service in IBM HTTP Server 8.5 and 9.0 lets an actor with write access to portions of the server configuration render the web server unavailable (CWE-400 resource exhaustion). IBM has released a fix and there is no public exploit identified at time of analysis; EPSS is negligible at 0.03% and CISA SSVC rates exploitation as 'none', indicating a low-urgency, precondition-heavy issue despite the 9.1 base score.
Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote attackers to crash the server by triggering a reachable assertion in the optional mod_fastcgi module. The flaw affects availability only (no data exposure or code execution) and, per the CVSS PR:N vector, requires no authentication, but exploitation depends on the non-default mod_fastcgi module being enabled. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 9th percentile), and it is not listed in CISA KEV.
Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote unauthenticated attackers to crash the web server when the optional mod_ibm_upload module is loaded, triggering a null pointer dereference (CWE-476). No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (4th percentile), though SSVC flags the issue as automatable with partial technical impact. Affected deployments include HTTP Server 8.5 up to Interim Fix 002 and HTTP Server 9.0, with a vendor patch available via IBM support note 7274065.
IBM i 7.2-7.6 contains an invalid authorization check in the Web Administration GUI that allows authenticated high-privilege users with administrator access to trigger privilege escalation, enabling user-controlled code execution with administrator privileges. The vulnerability requires high privileges and user interaction (CVSS:H for confidentiality, integrity, and availability), but is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been identified as of the analysis date.
Privilege escalation in IBM Turbonomic prometurbo agent allows compromised service accounts to exfiltrate cluster-wide Kubernetes secrets and achieve full cluster takeover. Affects versions 8.16.0 through 8.17.6 deployed in Kubernetes environments. The operator grants excessive RBAC permissions enabling unrestricted read access to all secrets cluster-wide. CVSS 8.8 indicates high severity with scope change to container/cluster level. No active exploitation confirmed (not in CISA KEV), but the attack path from service account compromise to cluster admin is well-understood in Kubernetes threat models.
IBM Langflow OSS 1.0.0 through 1.8.4 allows authenticated users to read transaction logs and vertex build data from other users' flows via direct flow_id manipulation, enabling unauthorized information disclosure and deletion of other users' persisted build data. The vulnerability requires valid user authentication (PR:L) but no additional complexity, affecting all deployments of affected versions.
Remote code execution in IBM Langflow Desktop 1.0.0 through 1.8.4 allows authenticated attackers to execute arbitrary commands at the privilege level of the Langflow process. Attackers can exfiltrate API keys and database credentials from environment variables, modify application files, or pivot to internal network targets. IBM has released a vendor patch addressing this code injection vulnerability. No active exploitation confirmed by CISA KEV at time of analysis, though CVSS 8.8 severity and low attack complexity indicate high exploitability once authenticated access is obtained.
Unauthenticated remote disclosure of user-uploaded images in IBM Langflow Desktop 1.0.0-1.8.4 allows network attackers to enumerate and access other users' private images through predictable object references. With CVSS 7.5 (High) reflecting unauthenticated network exploitation, and EPSS data not provided, risk depends on whether installations expose the vulnerable endpoint to untrusted networks. No KEV listing or public exploit code identified at time of analysis, suggesting discovery through vendor security review rather than active exploitation.
Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.
Remote code execution in IBM Total Storage Service Console (TSSC) and TS4500 IMC versions 9.2 through 9.6 allows unauthenticated attackers to execute arbitrary commands with normal user privileges via improper input validation. The vulnerability carries a CVSS score of 7.3 with network attack vector and low complexity (AV:N/AC:L/PR:N/UI:N), enabling remote exploitation without authentication. No public exploit identified at time of analysis, and EPSS risk data is not available for this 2026 CVE.
Remote code execution in IBM Langflow Desktop versions 1.6.0 through 1.8.2 allows authenticated attackers to execute arbitrary code via unsafe deserialization in the FAISS component. The vulnerability stems from an insecure default configuration that permits deserialization of untrusted data. With CVSS 8.8 (High) reflecting network accessibility, low complexity, and full impact on confidentiality, integrity, and availability, this represents a critical risk for organizations running affected versions. Vendor-released patch available through IBM security advisory. No public exploit identified at time of analysis, though the attack path is well-understood given the CWE-502 deserialization vulnerability class.
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deployments) allows unauthenticated local attackers to execute malicious scripts from outside the application's control sphere. This CWE-829 inclusion of functionality from untrusted control sphere vulnerability achieves container escape (scope change to C in CVSS vector), enabling high confidentiality impact and limited integrity/availability impact. No public exploit or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and lack of required privileges (PR:N) make this readily exploitable by local users.
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated local users to gain full system control via excessive process privileges (CWE-250). The CVSS 9.3 score reflects local attack vector but no authentication requirement (PR:N) and complete system compromise with scope change. Patch available per vendor advisory. No public exploit identified at time of analysis, though the local attack vector and low complexity (AC:L) suggest straightforward exploitation once local access is obtained.
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0.2) allows unauthenticated remote attackers to contact internal authentication endpoints that should be protected by the Reverse Proxy component. This bypass enables attackers to interact with restricted internal services, potentially leading to unauthorized information disclosure and limited integrity impact. EPSS data not provided, but CVSS 7.2 (High) with network-accessible, low-complexity attack vector indicates moderate real-world risk. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Command injection vulnerability in IBM Security Verify Access and IBM Verify Identity Access (versions 10.0-10.0.9.1 and 11.0-11.0.2, both containerized and non-containerized deployments) allows remote unauthenticated attackers to execute arbitrary commands with lower user privileges. The vulnerability stems from improper validation of user-supplied input (CWE-78). With CVSS 7.3 and network-accessible attack vector requiring no authentication or user interaction, this represents a significant exposure for internet-facing identity and access management infrastructure. No public exploit identified at time of analysis, though EPSS data not provided. Vendor patch available per IBM advisory.
Authentication bypass in IBM Verify Identity Access and IBM Security Verify Access (versions 10.0-10.0.9.1 and 11.0-11.0.2, both container and non-container deployments) allows remote attackers to gain unauthorized access under specific high-load conditions without authentication. The vulnerability carries an EPSS score indicating moderate exploitation probability, with vendor patch available but no confirmed active exploitation or public proof-of-concept at time of analysis. Attack complexity is rated high (AC:H), suggesting exploitation requires specific timing or environmental conditions related to load stress.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
IBM Sterling B2B Integrator and IBM Sterling File Gateway contain an authentication bypass vulnerability that allows remote unauthenticated attackers to view and delete business partners within communities, as well as delete entire communities. Multiple versions are affected including 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0. While the CVSS score is 7.1 (High), the vulnerability requires low attack complexity and no user interaction, making it straightforward to exploit over the network with low privileges.
A resource exhaustion vulnerability in IBM i 7.6 allows unauthenticated remote attackers to cause a denial of service by overwhelming the system with failed authentication attempts. The vulnerability stems from improper resource allocation during authentication processing, enabling attackers to consume system resources without valid credentials. While no active exploitation or proof-of-concept has been reported, the high CVSS score of 7.5 reflects the ease of remote exploitation without authentication.
IBM Trusteer Rapport 3.5.2309.290 contains an insecure DLL search path vulnerability that allows local attackers to execute arbitrary code by planting a malicious file in a compromised directory. The attack requires local system access but no user interaction or elevated privileges, making it exploitable by any local user. No patch is currently available for this high-severity vulnerability.
Infosphere Information Server versions up to 11.7.1.6 is affected by improper restriction of xml external entity reference (CVSS 7.1).
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenticated network attackers to execute arbitrary commands by sending malicious serialized Java objects exploiting the Apache Commons Collections InvokerTransformer class. This vulnerability is confirmed actively exploited in the wild per CISA KEV, with public exploit code available (Exploit-DB 41613) and an exceptionally high EPSS score of 93.49%, indicating near-certain exploitation probability. Affected products include Sterling B2B Integrator 5.2, Sterling Integrator 5.1, and Tivoli Common Reporting versions 2.1 through 3.1.2.1.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 21.0%.
Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code via an XFDL form with a long fontname value. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.3%.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2). Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via a long TabCaption string. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.2%.
Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.5%.
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.6%.
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 61.9%.
Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.0%.
Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.6%.
Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.4%.
Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 75.1%.
IBM Langflow OSS 1.0.0 through 1.12.4 does not properly sanitize secrets embedded in flows and projects when they are exported, so an authenticated remote user (CVSS PR:L) can obtain sensitive information that should have been stripped from the exported artifact, with confidentiality impact rated High and no integrity or availability effect. Exploitation requires a valid low-privilege account plus use of the flow-export or project-export functionality; the issue yields information disclosure only, not code execution or modification. No public exploit code was identified at time of analysis, no CISA KEV entry applies, and the vendor priority is this_month: Vendor-released patch available per the IBM advisory at https://www.ibm.com/support/pages/node/7293016.
Arbitrary file overwrite in IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote attacker with a valid low-privileged account supply a crafted pathname that escapes the intended restricted directory and overwrites files on the host. The defect is a pathname restriction failure (CWE-22) scored 6.5 with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the integrity impact is high while confidentiality and availability are unaffected, and the main barrier to exploitation is the requirement for an authenticated session. IBM has published a patch reference, and no public exploit code or confirmed active exploitation was identified at time of analysis; the trigger endpoint or parameter that accepts the pathname is not described in the available sources.
Resource exhaustion denial of service in IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote authenticated user consume resources without effective limits or throttling, degrading or disabling the service. The CVSS 3.1 score is 6.5 with availability-only impact (C:N/I:N/A:H) and PR:L, so a valid account is required; no public exploit has been identified at time of analysis. This is a moderate-severity availability issue prioritized for this month, not an urgent emergency.
Denial of service in IBM Langflow OSS 1.0.0 through 1.12.3 arises from OS command injection (CWE-78) that a remote authenticated attacker can use to degrade availability, while confidentiality and integrity remain unaffected under the vendor's CVSS 3.1 rating of 4.3. The vector confirms network reachability with low privileges (AV:N/AC:L/PR:L/UI:N) and no user interaction, and no public exploit was identified at time of analysis; IBM reports a vendor patch is available.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.3 allows a remote authenticated attacker to reach files outside an intended restricted directory and read sensitive information, giving a confidentiality-only impact (CVSS 3.1 score 6.5, C:H/I:N/A:N). Exploitation requires a valid Langflow account with only low privileges (PR:L), no user interaction, and network reachability, so the practical exposure is limited to credentialed users, insiders, or attackers who have already obtained Langflow credentials. No public exploit code has been identified and there is no CISA KEV entry at the time of analysis; IBM has published a vendor advisory covering the fix, and the issue is tracked as a moderate-priority, this-month item rather than an emergency.
Server-side request forgery (CWE-918) in IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote authenticated attacker with low privileges (CVSS PR:L) induce the server to make requests on their behalf, exposing limited confidential information (C:L, I:N, A:N) for a base score of 4.3. No user interaction is required and the flaw is network-reachable, but exploitation depends on an existing valid session on the Langflow instance, so the barrier is access rather than complexity. Exploitation has not been confirmed as active (no CISA KEV listing), no public exploit code is identified in the supplied data, and the specific endpoint or feature that triggers the SSRF is not described in the available sources.
Arbitrary file write on a victim's host can result from ZIP archives that IBM Langflow OSS 1.0.0 through 1.12.3 generates when an authenticated user drives the export function, because entry paths inside the archive are not constrained to the extraction directory. The attacker must already hold authenticated access to the instance (PR:L), and the impact only materializes when a second party downloads that server-generated archive and unpacks it with a non-sanitizing tool (UI:R), so the Langflow server itself is not directly compromised. Independent assessment rates this low severity (AC:H, integrity-only impact, no confidentiality or availability effect) and the priority signal is monitor; no public exploit has been identified at time of analysis and there is no KEV listing.
IBM Langflow OSS 1.0.0 through 1.12.3 can disclose a flow owner's stored third-party credentials in cleartext to an authenticated user who holds a read or share grant on that flow. The flaw is a moderate-priority credential exposure issue that matters in multi-user deployments where flows are shared across accounts; a single-user or unshared installation lacks the cross-user grant the attack depends on. Authentication is required (CVSS PR:L), no victim interaction is needed, and no public exploit identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.12.3 allows an authenticated user to coerce the Langflow server into making requests to destinations of the attacker's choosing, which can expose internal network topology and reveal reachable internal services. Scoring is modest (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) because the attacker must already hold a valid Langflow account and gains only limited confidentiality impact, with no integrity or availability effect. IBM has published a vendor fix via its support advisory; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a this-month remediation item rather than an emergency.
IBM Langflow OSS 1.0.0 through 1.12.3 allows any authenticated user who can identify another user's running background job to cancel it with a single HTTP request, destroying in-progress compute work because the cancellation path lacks a flow-level ownership check. The vendor scores this 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while independent assessment rates availability impact as low (A:L) and stresses the valid-account prerequisite and the greater exposure in shared or multi-tenant deployments; no data disclosure or modification is described. No public exploit identified at time of analysis, and a vendor patch is available.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.12.3 allows authenticated users to make the server issue requests to attacker-selected destinations, which can support limited internal-network enumeration and request relaying. The issue is rated CVSS 5.4 with limited confidentiality and integrity impact, requires a valid session (PR:L), and needs no user interaction. The supplied intelligence shows a vendor patch reference but no public exploit or CISA KEV entry; no public exploit was identified at time of analysis.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.12.4 lets a logged-in user submit a crafted URL request to read arbitrary files on the host, with high confidentiality impact but no integrity or availability impact. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and exploitation requires a valid authenticated session. No public exploit was identified at time of analysis, and IBM has published a vendor advisory and patch reference.
IBM Langflow OSS 1.0.0 through 1.12.8 can expose sensitive credentials to an authenticated remote attacker, producing a high confidentiality impact with no integrity or availability effect. The issue is classified as CWE-522 insufficiently protected credentials, and the CVSS vector requires a valid low-privileged account (PR:L) with network access and no user interaction. No public exploit was identified at time of analysis, while IBM has published a vendor patch advisory.
Cleartext storage of sensitive information in IBM Langflow OSS 1.0.0 through 1.12.4 allows an authenticated remote user to obtain data that should have been protected, with a confidentiality-only impact rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected scope is Langflow OSS 1.0.0 through 1.12.4; exploitation requires a valid low-privilege account, and no public exploit was identified at time of analysis. A vendor patch is available per IBM's advisory, although the provided data does not list an exact fixed version.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.4 allows a remote low-privilege authenticated user to read files outside an intended restricted directory, exposing sensitive information. Exploitation requires a valid account (PR:L) and no user interaction, and no public exploit was identified at time of analysis; a vendor patch is available. The published CVSS 3.1 base score is 8.8, but the independent assessment limits confirmed impact to confidentiality (C:H/I:N/A:N), so integrity and availability effects should not be assumed.
Cross-scope OAuth token reuse in Apache Camel's camel-oauth component (org.apache.camel:camel-oauth 4.19.0 through 4.22.1) lets a profile be handed a bearer token that was obtained under a different profile's scope or client secret. The resolver keeps tokens in a static, JVM-wide cache keyed only on the token endpoint and client ID, so two profiles sharing an identity provider client but differing in requested scope or secret collide on one entry. The result is an outbound call carrying a token that grants broader authority than the calling profile was configured for, or that was issued by a different client secret; the trigger requires a deployment defining multiple colliding profiles with caching (default-enabled) left on, and no public exploit has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops it: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere else - it only supplies the vendor, model and revision printed in the same loop. Once such a drive is removed, its scsi_device can never be released. It stays on the host's device list at its address, so a new device there is refused by anything that walks the list - target_core_pscsi reports "scsi_device_get() failed for H:C:T:L" - and the low-level driver's module can no longer be unloaded. Only a reboot recovers. It shows with any changer that reports its drives' ids; with the mhvtl virtual library (IBM 3573-TL personality), each create and remove of a library with four drives leaves four references behind, counted by the module's use count in lsmod. With ch not bound the count is unchanged, and with this patch applied it is unchanged too. Drop the reference as soon as the name has been printed, and remove the now unused dt[] array. That also removes the array leaked when ch_probe() fails after ch_readconfig(). The same leak was reported with an RFC patch in 2022, which was not merged.
IBM Cyber Fraud versions 1.0.0 through 1.0.2 issue session cookies without the Secure attribute, so a remote, unauthenticated attacker who already sits in a man-in-the-middle position on the network path can capture session data whenever the application is reached over plain HTTP (CVSS 3.7, AC:H, low confidentiality impact only). The flaw does not bypass authentication or grant direct access; it only widens exposure of cookies that are transmitted unencrypted. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and deployments that enforce HTTPS/HSTS end-to-end largely neutralize the issue.
Cross-site scripting in IBM Carbon Charts 0.4.0 through 1.27.19 lets remote attackers execute arbitrary JavaScript in a victim's browser session when the MeterChart title text exceeds the available container width and is truncated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates unauthenticated remote exploitation that requires the victim to load a page rendering the chart, with scope change and limited confidentiality/integrity impact. No public exploit code was identified at time of analysis, and practical exploitation depends on the host application passing attacker-influenced text into a MeterChart title and that title being long enough to trigger truncation.
Pre-authentication access control bypass in IBM i Navigator (7.3, 7.4, 7.5, and 7.6) lets a remote attacker alter server-side session security state by sending a crafted HTTP request to any Navigator URL before authenticating. The weakness is an improper authentication/access-control flaw (CWE-287) rated CVSS 6.5, with low confidentiality and integrity impact and no direct code execution or full account takeover; the practical risk is concentrated on Navigator interfaces that are reachable from untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Transfer Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1) through a heap-based buffer overflow in the asperahttpd component. An unauthenticated network attacker can corrupt memory to crash the service (denial of service) and, in the worst case, hijack execution flow to run arbitrary code or bypass authentication. There is no public exploit identified at time of analysis and SSVC lists exploitation as none, but the CVSS 9.8 rating and 'Automatable: yes' assessment mark this as a high-priority patching target.
Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 through 1.5.19 allows remote attackers to access and modify protected resources without valid credentials, scoring CVSS 9.1 critical. The flaw exposes confidential file transfer data and permits unauthorized modification of integrity-protected assets across all affected releases. No public exploit identified at time of analysis, and EPSS predicts only a 0.02% near-term exploitation probability despite the high severity rating.
Uncontrolled resource consumption in IBM Langflow OSS 1.0.0 through 1.9.0 lets remote attackers exhaust server resources and cause a denial of service against the Langflow service. The CVSS vector (AV:N/AC:L/PR:N/UI:N, availability-only impact rated 7.5) shows exploitation needs network reachability to the Langflow instance but no authentication and no user interaction; instances bound to localhost or shielded by an authenticated proxy or rate limiting carry much lower realistic exposure. No public exploit has been identified at time of analysis, CISA SSVC records no exploitation activity and classifies the flaw as not automatable, and EPSS is low at 0.04% (12th percentile), so overall risk is moderate rather than urgent.
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.1 lets unauthenticated network attackers run arbitrary code by abusing how the platform handles symbolic links while unpacking uploaded archives. Because extraction does not properly validate symlink targets, a crafted archive can write files outside the intended directory and ultimately achieve code execution on the host. The flaw carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is reachable without authentication or user interaction, though no public exploit identified at time of analysis.
Authentication can be bypassed on IBM Operations Analytics - Log Analysis deployments that still carry the default passwords created during the manufacturing/installation process, giving an attacker access to the installation instead of being challenged at login. Per IBM's published vector the attacker needs local access to the host and low-level existing privileges (AV:L/PR:L), which materially limits reach; the sources do not confirm whether the affected login interface is network-exposed, and our own assessment scores the reachability as network/unauthenticated in the worst case. Technical impact is total if the default credentials are unrotated, but no public exploit has been identified at time of analysis, EPSS is 0.02% (5th percentile), and SSVC records exploitation as none and automatable as no, so this reads as serious-but-not-urgent and is tracked for remediation this week.
Authorization bypass in IBM Db2 12.1.0 through 12.1.4 allows remote, unauthenticated attackers to manipulate data written to a remote object storage path by submitting a specially crafted query, an integrity-only impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Exposure is conditional rather than universal: only Db2 instances configured to integrate with remote object storage expose the vulnerable code path, and there is no public exploit identified at time of analysis (EPSS 0.02%, 7th percentile; CISA SSVC exploitation: none, Automatable: no). Because the flaw yields no confidentiality or availability loss and requires a specific deployment configuration, this is a moderate-priority issue rather than an urgent one despite its High CVSS rating.
Memory exhaustion in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 lets a user who can submit crafted SQL against MDC (multi-dimensional clustering) tables drive the database engine out of memory, degrading or halting availability with no confidentiality or integrity impact. The flaw is only reachable where the deployment actually uses MDC tables and where the triggering queries can be submitted; note that while the published CVSS vector lists PR:N, the assessed vector is PR:L, reflecting that a valid database connection and credentials are realistically required. Exploitation is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), EPSS is only 0.04% (12th percentile), and no public exploit code has been identified at time of analysis - every signal points to a moderate, low-urgency availability issue rather than a top priority.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 allows a user who can submit SQL to exhaust the statement heap with a specially crafted query while the engine is running with a small statement-heap configuration, degrading or halting availability for all sessions on the instance. This is a moderate-priority availability issue, not an urgent one: no public exploit was identified at time of analysis, EPSS is 0.01% (2nd percentile), CISA SSVC records an exploitation value of none with automatable set to no, and only availability is impacted (no confidentiality or integrity loss). The published NVD vector scores PR:N, but our assessment treats realistic exploitation as gated by at least a low-privilege database session (PR:L), and authentication requirements are not fully confirmed from available data and should be verified with IBM.
Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded secret - a password or cryptographic key - that the product uses for inbound authentication, outbound communication, or encryption of internal data. Because the credential is the same across every deployment, an attacker who already holds low-level access (CVSS PR:L) can leverage it to gain full confidentiality, integrity, and availability impact (C:H/I:H/A:H) over the network. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Memory-resource exhaustion in IBM WebSphere Application Server - traditional 9.0 and 8.5, plus WebSphere Application Server Liberty 19.0.0.7 through 26.0.0.5 - allows a remote, unauthenticated attacker to deny service by sending a specially crafted request (CWE-400, CVSS 7.5, impact confined to Availability:High with no confidentiality or integrity effect). Per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to an affected HTTP/application endpoint, with no authentication, user interaction, or non-default configuration identified, so default deployments appear reachable. Risk is tempered by the signals: no public exploit code and no confirmed active exploitation were identified (not in CISA KEV), EPSS is very low at 0.04% (14th percentile), and CISA SSVC rates exploitation as none with the attack assessed as not automatable, indicating the attacker must hand-craft a specific request rather than mass-scan.
Local privilege escalation in IBM Netezza Performance Server Replication Services (versions 3.0.2.0 through 3.0.5.0) allows an already-authenticated, low-privileged user on the appliance to gain full root control. By abusing the over-privileged Replication Services component the attacker can execute root-level commands, spawn a root shell, reset the root password, alter or delete system-wide files, and plant persistent backdoors, resulting in complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and no EPSS score was supplied in the source data, so the issue currently reflects vendor-reported risk rather than observed exploitation.
Directory traversal in IBM InfoSphere Optim Test Data Fabrication (versions 1.0.0 through 1.0.2.7) lets a remote, unauthenticated attacker read arbitrary files from the host by sending a crafted URL containing '../' sequences. The flaw is purely an information-disclosure issue - confidentiality is impacted with no integrity or availability effect - and CVSS rates it 7.5 (High). There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation status as none, though it flags the issue as automatable.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 can be triggered by a specially crafted query when the autonomous transactions feature is enabled, allowing an attacker to exhaust resources and take the database instance down. Exposure is materially limited to deployments that have enabled autonomous transactions and to callers able to submit queries; authentication requirements are not fully confirmed from the available data, and the PR:N rating in the published vector should be verified against IBM's advisory. No public exploit code or active exploitation is identified, EPSS is 0.04% (12th percentile), CISA SSVC records exploitation as none, and the vuln.today priority label is this_week.
Authorization bypass in IBM Engineering Lifecycle Management (ELM) 7.0.3, 7.1.0, and 7.2.0 allows unauthenticated remote attackers to modify server property files and gain unauthorized access to the application. The flaw carries a critical CVSS 9.8 score with full confidentiality, integrity, and availability impact, and IBM has released Interim Fixes addressing it. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.03%, 10th percentile).
XML External Entity (XXE) injection in IBM Engineering Lifecycle Management (ELM) 7.0.3, 7.1.0, and 7.2.0 allows authenticated attackers to disclose sensitive information or exhaust memory resources by submitting crafted XML data to the application. The flaw carries a CVSS 7.1 (High) rating with low attack complexity over the network, but EPSS is only 0.02% (5th percentile) and there is no public exploit identified at time of analysis. SSVC classifies exploitation as 'none' with partial technical impact, indicating low immediate urgency despite the vendor-released patch.
Remote code execution in IBM Engineering Lifecycle Management (ELM) versions 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 through Interim Fix 001 allows an attacker with administrative privileges to execute arbitrary code via an exposed method that is not properly restricted (CWE-749). At time of analysis there is no public exploit identified and EPSS is very low (0.01%), but the SSVC technical impact is rated total, making this a high-impact post-authentication issue against ELM administrators. IBM has published a patch advisory and CVSS is 7.2 (AV:N/AC:L/PR:H/UI:N/C:H/I:H/A:H).
Remote code execution and denial of service in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 stem from improper input validation (CWE-444 HTTP Request Smuggling). Unauthenticated network attackers can send crafted requests that desynchronize the plug-in's request parsing, potentially achieving full compromise of the application tier. No public exploit identified at time of analysis, and EPSS remains low (0.06%), but the vendor confirms a patch and CISA SSVC rates the technical impact as total with automatable exploitation.
Remote code execution in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 allows unauthenticated network attackers to execute arbitrary code via a specially crafted HTTP request. The CVSS 9.8 rating reflects complete confidentiality, integrity, and availability impact with no authentication or user interaction required, though EPSS scores it at only 0.20% probability and CISA SSVC reports no current exploitation. No public exploit has been identified at time of analysis, but IBM has released a patch.
HTTP request smuggling in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 allows remote unauthenticated attackers to send specially crafted requests that desynchronize front-end and back-end HTTP parsing. Successful exploitation enables cache poisoning, security control bypass, and limited disclosure or modification of data passing through the plug-in, with a CVSS 7.5 reflecting a Changed scope and high confidentiality impact. There is no public exploit identified at time of analysis, EPSS is low at 0.05% (15th percentile), and CISA SSVC marks exploitation status as none.
Invalid pointer dereference in IBM HTTP Server 8.5 and 9.0 allows an authenticated privileged user on the Administration Server to expose sensitive information or trigger a denial-of-service condition. The flaw requires adjacent network access and existing low-level privileges, and no public exploit identified at time of analysis. EPSS exploitation probability is negligible (0.01%) and CISA SSVC indicates no observed exploitation.
Heap-based buffer overflow in IBM HTTP Server 8.5 and 9.0 allows an attacker already authenticated to the Administration Server to execute arbitrary code or crash the service. The flaw requires adjacent network access and existing low-level privileges, and no public exploit identified at time of analysis despite the high CVSS 8.0 rating. EPSS probability is negligible (0.01%) and SSVC marks exploitation as 'none,' indicating the issue is currently a patch-and-move-on item rather than an emergency.
Remote code execution and denial of service affect IBM HTTP Server 8.5 and 9.0 when deployed with TLS mutual (client certificate) authentication enabled. The flaw is a code injection weakness (CWE-94) that a network-based attacker can leverage to fully compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.24%, 47th percentile), indicating no observed weaponization yet despite the maximal 9.8 CVSS.
Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote unauthenticated attackers to crash or degrade the service when the optional mod_mem_cache module is loaded. The flaw carries a CVSS 7.5 (availability-only impact) and has no public exploit identified at time of analysis, though the SSVC framework rates exploitation as automatable. EPSS probability is very low (0.01%, 3rd percentile), suggesting limited near-term exploitation interest.
Denial of service in IBM HTTP Server 8.5 and 9.0 lets an actor with write access to portions of the server configuration render the web server unavailable (CWE-400 resource exhaustion). IBM has released a fix and there is no public exploit identified at time of analysis; EPSS is negligible at 0.03% and CISA SSVC rates exploitation as 'none', indicating a low-urgency, precondition-heavy issue despite the 9.1 base score.
Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote attackers to crash the server by triggering a reachable assertion in the optional mod_fastcgi module. The flaw affects availability only (no data exposure or code execution) and, per the CVSS PR:N vector, requires no authentication, but exploitation depends on the non-default mod_fastcgi module being enabled. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 9th percentile), and it is not listed in CISA KEV.
Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote unauthenticated attackers to crash the web server when the optional mod_ibm_upload module is loaded, triggering a null pointer dereference (CWE-476). No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (4th percentile), though SSVC flags the issue as automatable with partial technical impact. Affected deployments include HTTP Server 8.5 up to Interim Fix 002 and HTTP Server 9.0, with a vendor patch available via IBM support note 7274065.
IBM i 7.2-7.6 contains an invalid authorization check in the Web Administration GUI that allows authenticated high-privilege users with administrator access to trigger privilege escalation, enabling user-controlled code execution with administrator privileges. The vulnerability requires high privileges and user interaction (CVSS:H for confidentiality, integrity, and availability), but is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been identified as of the analysis date.
Privilege escalation in IBM Turbonomic prometurbo agent allows compromised service accounts to exfiltrate cluster-wide Kubernetes secrets and achieve full cluster takeover. Affects versions 8.16.0 through 8.17.6 deployed in Kubernetes environments. The operator grants excessive RBAC permissions enabling unrestricted read access to all secrets cluster-wide. CVSS 8.8 indicates high severity with scope change to container/cluster level. No active exploitation confirmed (not in CISA KEV), but the attack path from service account compromise to cluster admin is well-understood in Kubernetes threat models.
IBM Langflow OSS 1.0.0 through 1.8.4 allows authenticated users to read transaction logs and vertex build data from other users' flows via direct flow_id manipulation, enabling unauthorized information disclosure and deletion of other users' persisted build data. The vulnerability requires valid user authentication (PR:L) but no additional complexity, affecting all deployments of affected versions.
Remote code execution in IBM Langflow Desktop 1.0.0 through 1.8.4 allows authenticated attackers to execute arbitrary commands at the privilege level of the Langflow process. Attackers can exfiltrate API keys and database credentials from environment variables, modify application files, or pivot to internal network targets. IBM has released a vendor patch addressing this code injection vulnerability. No active exploitation confirmed by CISA KEV at time of analysis, though CVSS 8.8 severity and low attack complexity indicate high exploitability once authenticated access is obtained.
Unauthenticated remote disclosure of user-uploaded images in IBM Langflow Desktop 1.0.0-1.8.4 allows network attackers to enumerate and access other users' private images through predictable object references. With CVSS 7.5 (High) reflecting unauthenticated network exploitation, and EPSS data not provided, risk depends on whether installations expose the vulnerable endpoint to untrusted networks. No KEV listing or public exploit code identified at time of analysis, suggesting discovery through vendor security review rather than active exploitation.
Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.
Remote code execution in IBM Total Storage Service Console (TSSC) and TS4500 IMC versions 9.2 through 9.6 allows unauthenticated attackers to execute arbitrary commands with normal user privileges via improper input validation. The vulnerability carries a CVSS score of 7.3 with network attack vector and low complexity (AV:N/AC:L/PR:N/UI:N), enabling remote exploitation without authentication. No public exploit identified at time of analysis, and EPSS risk data is not available for this 2026 CVE.
Remote code execution in IBM Langflow Desktop versions 1.6.0 through 1.8.2 allows authenticated attackers to execute arbitrary code via unsafe deserialization in the FAISS component. The vulnerability stems from an insecure default configuration that permits deserialization of untrusted data. With CVSS 8.8 (High) reflecting network accessibility, low complexity, and full impact on confidentiality, integrity, and availability, this represents a critical risk for organizations running affected versions. Vendor-released patch available through IBM security advisory. No public exploit identified at time of analysis, though the attack path is well-understood given the CWE-502 deserialization vulnerability class.
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deployments) allows unauthenticated local attackers to execute malicious scripts from outside the application's control sphere. This CWE-829 inclusion of functionality from untrusted control sphere vulnerability achieves container escape (scope change to C in CVSS vector), enabling high confidentiality impact and limited integrity/availability impact. No public exploit or active exploitation confirmed at time of analysis, though the low attack complexity (AC:L) and lack of required privileges (PR:N) make this readily exploitable by local users.
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated local users to gain full system control via excessive process privileges (CWE-250). The CVSS 9.3 score reflects local attack vector but no authentication requirement (PR:N) and complete system compromise with scope change. Patch available per vendor advisory. No public exploit identified at time of analysis, though the local attack vector and low complexity (AC:L) suggest straightforward exploitation once local access is obtained.
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0.2) allows unauthenticated remote attackers to contact internal authentication endpoints that should be protected by the Reverse Proxy component. This bypass enables attackers to interact with restricted internal services, potentially leading to unauthorized information disclosure and limited integrity impact. EPSS data not provided, but CVSS 7.2 (High) with network-accessible, low-complexity attack vector indicates moderate real-world risk. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Command injection vulnerability in IBM Security Verify Access and IBM Verify Identity Access (versions 10.0-10.0.9.1 and 11.0-11.0.2, both containerized and non-containerized deployments) allows remote unauthenticated attackers to execute arbitrary commands with lower user privileges. The vulnerability stems from improper validation of user-supplied input (CWE-78). With CVSS 7.3 and network-accessible attack vector requiring no authentication or user interaction, this represents a significant exposure for internet-facing identity and access management infrastructure. No public exploit identified at time of analysis, though EPSS data not provided. Vendor patch available per IBM advisory.
Authentication bypass in IBM Verify Identity Access and IBM Security Verify Access (versions 10.0-10.0.9.1 and 11.0-11.0.2, both container and non-container deployments) allows remote attackers to gain unauthorized access under specific high-load conditions without authentication. The vulnerability carries an EPSS score indicating moderate exploitation probability, with vendor patch available but no confirmed active exploitation or public proof-of-concept at time of analysis. Attack complexity is rated high (AC:H), suggesting exploitation requires specific timing or environmental conditions related to load stress.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
IBM Sterling B2B Integrator and IBM Sterling File Gateway contain an authentication bypass vulnerability that allows remote unauthenticated attackers to view and delete business partners within communities, as well as delete entire communities. Multiple versions are affected including 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0. While the CVSS score is 7.1 (High), the vulnerability requires low attack complexity and no user interaction, making it straightforward to exploit over the network with low privileges.
A resource exhaustion vulnerability in IBM i 7.6 allows unauthenticated remote attackers to cause a denial of service by overwhelming the system with failed authentication attempts. The vulnerability stems from improper resource allocation during authentication processing, enabling attackers to consume system resources without valid credentials. While no active exploitation or proof-of-concept has been reported, the high CVSS score of 7.5 reflects the ease of remote exploitation without authentication.
IBM Trusteer Rapport 3.5.2309.290 contains an insecure DLL search path vulnerability that allows local attackers to execute arbitrary code by planting a malicious file in a compromised directory. The attack requires local system access but no user interaction or elevated privileges, making it exploitable by any local user. No patch is currently available for this high-severity vulnerability.
Infosphere Information Server versions up to 11.7.1.6 is affected by improper restriction of xml external entity reference (CVSS 7.1).
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenticated network attackers to execute arbitrary commands by sending malicious serialized Java objects exploiting the Apache Commons Collections InvokerTransformer class. This vulnerability is confirmed actively exploited in the wild per CISA KEV, with public exploit code available (Exploit-DB 41613) and an exceptionally high EPSS score of 93.49%, indicating near-certain exploitation probability. Affected products include Sterling B2B Integrator 5.2, Sterling Integrator 5.1, and Tivoli Common Reporting versions 2.1 through 3.1.2.1.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 21.0%.
Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code via an XFDL form with a long fontname value. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.3%.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2). Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via a long TabCaption string. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.2%.
Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.5%.
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.6%.
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 61.9%.
Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.0%.
Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.6%.
Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.4%.
Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 75.1%.
IBM Langflow OSS 1.0.0 through 1.12.4 does not properly sanitize secrets embedded in flows and projects when they are exported, so an authenticated remote user (CVSS PR:L) can obtain sensitive information that should have been stripped from the exported artifact, with confidentiality impact rated High and no integrity or availability effect. Exploitation requires a valid low-privilege account plus use of the flow-export or project-export functionality; the issue yields information disclosure only, not code execution or modification. No public exploit code was identified at time of analysis, no CISA KEV entry applies, and the vendor priority is this_month: Vendor-released patch available per the IBM advisory at https://www.ibm.com/support/pages/node/7293016.
Arbitrary file overwrite in IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote attacker with a valid low-privileged account supply a crafted pathname that escapes the intended restricted directory and overwrites files on the host. The defect is a pathname restriction failure (CWE-22) scored 6.5 with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the integrity impact is high while confidentiality and availability are unaffected, and the main barrier to exploitation is the requirement for an authenticated session. IBM has published a patch reference, and no public exploit code or confirmed active exploitation was identified at time of analysis; the trigger endpoint or parameter that accepts the pathname is not described in the available sources.
Resource exhaustion denial of service in IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote authenticated user consume resources without effective limits or throttling, degrading or disabling the service. The CVSS 3.1 score is 6.5 with availability-only impact (C:N/I:N/A:H) and PR:L, so a valid account is required; no public exploit has been identified at time of analysis. This is a moderate-severity availability issue prioritized for this month, not an urgent emergency.
Denial of service in IBM Langflow OSS 1.0.0 through 1.12.3 arises from OS command injection (CWE-78) that a remote authenticated attacker can use to degrade availability, while confidentiality and integrity remain unaffected under the vendor's CVSS 3.1 rating of 4.3. The vector confirms network reachability with low privileges (AV:N/AC:L/PR:L/UI:N) and no user interaction, and no public exploit was identified at time of analysis; IBM reports a vendor patch is available.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.3 allows a remote authenticated attacker to reach files outside an intended restricted directory and read sensitive information, giving a confidentiality-only impact (CVSS 3.1 score 6.5, C:H/I:N/A:N). Exploitation requires a valid Langflow account with only low privileges (PR:L), no user interaction, and network reachability, so the practical exposure is limited to credentialed users, insiders, or attackers who have already obtained Langflow credentials. No public exploit code has been identified and there is no CISA KEV entry at the time of analysis; IBM has published a vendor advisory covering the fix, and the issue is tracked as a moderate-priority, this-month item rather than an emergency.
Server-side request forgery (CWE-918) in IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote authenticated attacker with low privileges (CVSS PR:L) induce the server to make requests on their behalf, exposing limited confidential information (C:L, I:N, A:N) for a base score of 4.3. No user interaction is required and the flaw is network-reachable, but exploitation depends on an existing valid session on the Langflow instance, so the barrier is access rather than complexity. Exploitation has not been confirmed as active (no CISA KEV listing), no public exploit code is identified in the supplied data, and the specific endpoint or feature that triggers the SSRF is not described in the available sources.
Arbitrary file write on a victim's host can result from ZIP archives that IBM Langflow OSS 1.0.0 through 1.12.3 generates when an authenticated user drives the export function, because entry paths inside the archive are not constrained to the extraction directory. The attacker must already hold authenticated access to the instance (PR:L), and the impact only materializes when a second party downloads that server-generated archive and unpacks it with a non-sanitizing tool (UI:R), so the Langflow server itself is not directly compromised. Independent assessment rates this low severity (AC:H, integrity-only impact, no confidentiality or availability effect) and the priority signal is monitor; no public exploit has been identified at time of analysis and there is no KEV listing.
IBM Langflow OSS 1.0.0 through 1.12.3 can disclose a flow owner's stored third-party credentials in cleartext to an authenticated user who holds a read or share grant on that flow. The flaw is a moderate-priority credential exposure issue that matters in multi-user deployments where flows are shared across accounts; a single-user or unshared installation lacks the cross-user grant the attack depends on. Authentication is required (CVSS PR:L), no victim interaction is needed, and no public exploit identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.12.3 allows an authenticated user to coerce the Langflow server into making requests to destinations of the attacker's choosing, which can expose internal network topology and reveal reachable internal services. Scoring is modest (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) because the attacker must already hold a valid Langflow account and gains only limited confidentiality impact, with no integrity or availability effect. IBM has published a vendor fix via its support advisory; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a this-month remediation item rather than an emergency.
IBM Langflow OSS 1.0.0 through 1.12.3 allows any authenticated user who can identify another user's running background job to cancel it with a single HTTP request, destroying in-progress compute work because the cancellation path lacks a flow-level ownership check. The vendor scores this 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while independent assessment rates availability impact as low (A:L) and stresses the valid-account prerequisite and the greater exposure in shared or multi-tenant deployments; no data disclosure or modification is described. No public exploit identified at time of analysis, and a vendor patch is available.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.12.3 allows authenticated users to make the server issue requests to attacker-selected destinations, which can support limited internal-network enumeration and request relaying. The issue is rated CVSS 5.4 with limited confidentiality and integrity impact, requires a valid session (PR:L), and needs no user interaction. The supplied intelligence shows a vendor patch reference but no public exploit or CISA KEV entry; no public exploit was identified at time of analysis.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.12.4 lets a logged-in user submit a crafted URL request to read arbitrary files on the host, with high confidentiality impact but no integrity or availability impact. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and exploitation requires a valid authenticated session. No public exploit was identified at time of analysis, and IBM has published a vendor advisory and patch reference.
IBM Langflow OSS 1.0.0 through 1.12.8 can expose sensitive credentials to an authenticated remote attacker, producing a high confidentiality impact with no integrity or availability effect. The issue is classified as CWE-522 insufficiently protected credentials, and the CVSS vector requires a valid low-privileged account (PR:L) with network access and no user interaction. No public exploit was identified at time of analysis, while IBM has published a vendor patch advisory.
Cleartext storage of sensitive information in IBM Langflow OSS 1.0.0 through 1.12.4 allows an authenticated remote user to obtain data that should have been protected, with a confidentiality-only impact rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected scope is Langflow OSS 1.0.0 through 1.12.4; exploitation requires a valid low-privilege account, and no public exploit was identified at time of analysis. A vendor patch is available per IBM's advisory, although the provided data does not list an exact fixed version.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.4 allows a remote low-privilege authenticated user to read files outside an intended restricted directory, exposing sensitive information. Exploitation requires a valid account (PR:L) and no user interaction, and no public exploit was identified at time of analysis; a vendor patch is available. The published CVSS 3.1 base score is 8.8, but the independent assessment limits confirmed impact to confidentiality (C:H/I:N/A:N), so integrity and availability effects should not be assumed.
Cross-scope OAuth token reuse in Apache Camel's camel-oauth component (org.apache.camel:camel-oauth 4.19.0 through 4.22.1) lets a profile be handed a bearer token that was obtained under a different profile's scope or client secret. The resolver keeps tokens in a static, JVM-wide cache keyed only on the token endpoint and client ID, so two profiles sharing an identity provider client but differing in requested scope or secret collide on one entry. The result is an outbound call carrying a token that grants broader authority than the calling profile was configured for, or that was issued by a different client secret; the trigger requires a deployment defining multiple colliding profiles with caching (default-enabled) left on, and no public exploit has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops it: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere else - it only supplies the vendor, model and revision printed in the same loop. Once such a drive is removed, its scsi_device can never be released. It stays on the host's device list at its address, so a new device there is refused by anything that walks the list - target_core_pscsi reports "scsi_device_get() failed for H:C:T:L" - and the low-level driver's module can no longer be unloaded. Only a reboot recovers. It shows with any changer that reports its drives' ids; with the mhvtl virtual library (IBM 3573-TL personality), each create and remove of a library with four drives leaves four references behind, counted by the module's use count in lsmod. With ch not bound the count is unchanged, and with this patch applied it is unchanged too. Drop the reference as soon as the name has been printed, and remove the now unused dt[] array. That also removes the array leaked when ch_probe() fails after ch_readconfig(). The same leak was reported with an RFC patch in 2022, which was not merged.
IBM Cyber Fraud versions 1.0.0 through 1.0.2 issue session cookies without the Secure attribute, so a remote, unauthenticated attacker who already sits in a man-in-the-middle position on the network path can capture session data whenever the application is reached over plain HTTP (CVSS 3.7, AC:H, low confidentiality impact only). The flaw does not bypass authentication or grant direct access; it only widens exposure of cookies that are transmitted unencrypted. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and deployments that enforce HTTPS/HSTS end-to-end largely neutralize the issue.
Cross-site scripting in IBM Carbon Charts 0.4.0 through 1.27.19 lets remote attackers execute arbitrary JavaScript in a victim's browser session when the MeterChart title text exceeds the available container width and is truncated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates unauthenticated remote exploitation that requires the victim to load a page rendering the chart, with scope change and limited confidentiality/integrity impact. No public exploit code was identified at time of analysis, and practical exploitation depends on the host application passing attacker-influenced text into a MeterChart title and that title being long enough to trigger truncation.
Pre-authentication access control bypass in IBM i Navigator (7.3, 7.4, 7.5, and 7.6) lets a remote attacker alter server-side session security state by sending a crafted HTTP request to any Navigator URL before authenticating. The weakness is an improper authentication/access-control flaw (CWE-287) rated CVSS 6.5, with low confidentiality and integrity impact and no direct code execution or full account takeover; the practical risk is concentrated on Navigator interfaces that are reachable from untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis.