IBM
Monthly
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a targeted rather than mass-exploitation risk.
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local authenticated attacker to inject a rogue certificate authority and subsequently intercept or manipulate TLS-protected communications. The writable truststore breaks the chain of trust at the client level, enabling man-in-the-middle attacks against sessions the client believes are cryptographically secured. No public exploit or active exploitation has been identified at time of analysis, and EPSS probability is extremely low at 0.09%.
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Remote code execution in IBM Informix Dynamic Server 14.10, 12.10.x, and 15.0 is possible through a stack-based buffer overflow (CWE-121) in the oninit daemon's sq_sgkprepare function, triggered when processing a SQL interface request containing an unchecked length field. An authenticated, network-adjacent attacker with low-privilege SQL credentials can exploit this to achieve full compromise of the database server, resulting in complete confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; IBM has released a patch via Security Advisory 7283143.
OS command injection in IBM i 7.3 through 7.6 allows a remote authenticated attacker to execute arbitrary operating system commands with the privileges of the affected service. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78), covering all four current IBM i release lines. No public exploit or CISA KEV listing has been identified at time of analysis, but the high CVSS score of 8.8 and full CIA impact triad reflect serious post-authentication risk on a platform commonly used for enterprise workloads.
SQL injection in IBM i (the operating system for IBM Power/AS400 midrange systems) versions 7.3, 7.4, 7.5, and 7.6 lets a remote attacker submit specially crafted SQL statements that reach the back-end database, enabling unauthorized read, insert, modification, or deletion of stored data. IBM assigned a 9.8 CVSS reflecting full confidentiality, integrity, and availability impact, though CISA's SSVC framework rates technical impact only as 'partial' and exploitation as 'none observed.' There is no public exploit identified at time of analysis, and EPSS is low at 0.22% (13th percentile).
Privilege escalation in IBM i 7.3 through 7.6 allows remote authenticated attackers to gain elevated privileges by submitting a crafted, client-supplied profile name that bypasses server-side validation. The root cause is improper privilege management (CWE-269) in profile name handling, enabling an attacker with only low-level authenticated access to escalate to higher system privileges. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and high impact across confidentiality, integrity, and availability make this a serious priority for IBM i environments.
Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 arises from a stack-based buffer overflow that lets a remote attacker run arbitrary code on the host operating system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact to confidentiality, integrity, and availability, scoring 9.8 (Critical). IBM has published a fix, but there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote command injection in IBM i 7.3 through 7.6 allows a network-accessible authenticated attacker to execute arbitrary OS commands by supplying shell metacharacters in unsanitized input, resulting in full confidentiality, integrity, and availability compromise of the affected system. IBM confirmed and patched this vulnerability, documented at https://www.ibm.com/support/pages/node/7283275. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication bar make this a credible threat to any internet-exposed IBM i environment.
Remote code execution in IBM i 7.3 through 7.6 is exploitable by a remote authenticated attacker via improper bounds checking (CWE-787: Out-of-bounds Write). The high integrity impact (I:H) in the CVSS vector confirms that successful exploitation allows an attacker to overwrite memory and achieve arbitrary code execution on the affected IBM Power Systems platform. No public exploit identified at time of analysis, and IBM has released a vendor patch; however, the low-privilege authentication requirement (PR:L) broadens the attacker pool to any valid system user.
Denial of service in IBM i 7.3 through 7.6 allows an unauthenticated remote attacker to crash or render unavailable affected system services by sending input that bypasses server-side size validation. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), and the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no special conditions, and no user interaction. IBM i systems typically host irreplaceable mission-critical business workloads in sectors such as banking and manufacturing, making availability disruption disproportionately impactful despite the absence of code execution; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to run arbitrary code via an out-of-bounds write (CWE-787) memory-corruption flaw. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), indicating unauthenticated network exploitation with no user interaction against affected releases. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so the 9.8 rating reflects potential impact rather than confirmed exploitation.
Privilege escalation to root authority in IBM i 7.3 through 7.6 is achievable by any authenticated low-privileged user via a remote code execution flaw in the activation engine component. The activation engine executes with unnecessary system privileges (CWE-250), allowing a planted malicious script to run with root authority, resulting in full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has released a patch and the low attack complexity makes this a credible near-term threat for unpatched IBM i environments.
Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers with low-privilege credentials to obtain sensitive information across a security scope boundary, yielding a high confidentiality impact. The CVSS vector (S:C/C:H) indicates the leaked data can originate from components outside the attacker's immediate security context - a notable escalation beyond typical information disclosure. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283280.
OS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execute arbitrary operating-system commands on the affected IBM i host by injecting unneutralized special characters into a command the product builds and runs. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact and a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but a vendor patch is available and the low attack complexity makes this a high-priority fix.
Remote code execution in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated attacker to run arbitrary code by abusing an uncontrolled search path element (CWE-427), where a program resolves a library, service program, or executable from an attacker-influenceable location. Because the CVSS scope is changed (S:C), successful exploitation can execute code in a security context beyond the attacker's own low-privileged account, effectively enabling privilege escalation on this enterprise Power-based operating system. IBM has released a fix and there is no public exploit identified at time of analysis, but the 9.9 base score reflects severe impact once a foothold exists.
Remote OS command injection in IBM i 7.5 and 7.6 enables authenticated attackers with low-privilege network access to execute arbitrary commands with elevated system privileges, resulting in complete compromise of confidentiality, integrity, and availability. The flaw (CWE-78) arises from improper neutralization of special characters passed to OS command processing functions without adequate sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and network-accessible attack surface make this a high-priority remediation target for any IBM i deployment.
OS command injection in IBM i 7.5 and 7.6 enables a local attacker holding low-level credentials to escalate privileges to a highly elevated system authority level by injecting shell metacharacters into an unsanitized OS command interface (CWE-78). Both release streams - 7.5 and 7.6 - running on IBM Power Systems hardware are confirmed affected per the IBM advisory. IBM has released a patch via their support portal; no CISA KEV listing and no public exploit code have been identified at time of analysis.
IBM i versions 7.3 through 7.6 expose their TCP/IP stack to a remotely-triggered denial of service when processing zero-length TCP option fields. Classified as CWE-835 (Loop with Unreachable Exit Condition), the flaw causes the TCP stack to enter an infinite or unrecoverable processing loop upon receipt of malformed TCP options, exhausting CPU or thread resources and disrupting hosted business services. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N CVSS vector means any network-reachable IBM i system is exploitable without credentials or special conditions.
Remote authenticated attackers can execute arbitrary commands on IBM i 7.3 through 7.6 by exploiting improper privilege management (CWE-250), achieving full confidentiality, integrity, and availability compromise on affected systems. The CVSS vector of AV:N/AC:L/PR:L/UI:N confirms that only a low-privileged account and network reachability are required - no complex preconditions or user interaction needed. IBM has confirmed the vulnerability and released a patch via advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in IBM i 7.3 through 7.6 enables a local authenticated attacker to cause a denial of service - and potentially achieve broader data confidentiality and integrity impact - by submitting SQL commands containing improperly neutralized special elements. The flaw (CWE-89) is exploitable without user interaction once local access is obtained. No public exploit code has been identified and CISA has not listed this in KEV; a vendor patch is available.
IBM i versions 7.3 through 7.6 expose arbitrary Control Language (CL) command execution to remote authenticated attackers through insufficient input validation in a network-accessible interface. Any low-privileged IBM i user account is sufficient to exploit this flaw, enabling high-impact compromise of confidentiality and integrity on the affected system. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad version range across currently supported IBM i releases make this a meaningful patching priority for affected enterprises.
Privilege escalation in IBM i (formerly OS/400) releases 7.3 through 7.6 lets a remote authenticated user with low privileges gain higher, potentially all-object, authority by abusing improper authorization checks in the handling of high-authority threads. The flaw is scored CVSS 9.9 because of a scope change (S:C) that lets a foothold on the platform lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS is low at 0.24%, but a vendor patch is available.
Privilege escalation in IBM i versions 7.3 through 7.6 via the Navigator for i web-based administration interface allows an authenticated low-privileged user to elevate their session to root and execute arbitrary commands on the system. The CVSS 3.1 score of 8.8 (PR:L, AV:N, AC:L) reflects that exploitation requires only valid credentials and network access to the Navigator for i interface, with full confidentiality, integrity, and availability impact upon success. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote authenticated command execution in IBM i 7.3 through 7.6 stems from improper privilege management during monitor owner reassignment, a specific system management function. An attacker holding low-privileged credentials can exploit this flaw over the network without user interaction to execute arbitrary commands, achieving both high confidentiality and high integrity impact on the affected system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and authentication barrier make this a credible threat in any environment with broad user access to IBM i.
Credential harvesting in IBM i (via its Navigator for i web administration console) allows a remote unauthenticated attacker to spoof the legitimate Navigator for i interface and trick operators into disclosing their credentials, per IBM's advisory covering releases 7.6, 7.5, 7.4, and 7.3. The flaw is a CWE-346 origin-validation weakness carrying a CVSS 9.8 rating, though real-world exploitation signals are modest - there is no public exploit identified at time of analysis and EPSS sits at just 0.18% (7th percentile). A vendor patch is available.
Path traversal in IBM i 7.3 through 7.6 allows remote authenticated attackers to read sensitive files and write or manipulate files outside intended directory boundaries. The vulnerability is reachable over the network with only low-privilege credentials, making it accessible to a broad set of authenticated users in multi-tenant or shared IBM i environments. No active exploitation or public proof-of-concept has been identified at time of analysis, and IBM has released a patch via their support portal.
Security restriction bypass in IBM i 7.3 through 7.6 enables remote authenticated attackers to elevate privileges via unsafe Java reflection (CWE-915), allowing dynamic modification of object attributes in ways the platform's access control layer does not anticipate. The CVSS 8.3 score reflects network reachability, low attack complexity, and high confidentiality and integrity impact - meaning any valid low-privilege account can exploit this without user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low barrier to exploitation (PR:L, AC:L) makes this a credible lateral-movement or privilege-escalation path in IBM i shops.
XML injection in IBM i versions 7.3 through 7.6 enables a remote low-privileged authenticated attacker to exfiltrate sensitive information and compromise system integrity without disrupting availability. The CVSS 8.1 High score reflects a network-accessible, low-complexity attack path requiring only a standard user account. No public exploit has been identified at time of analysis; a vendor-released patch is available via IBM's support portal.
Privilege escalation via OS command injection in IBM i Navigator for i (versions 7.3 through 7.6) allows any authenticated, low-privileged network user to execute arbitrary OS commands as the root user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms this is a low-complexity, network-accessible exploit requiring only a valid user account - no additional privileges or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full CIA impact make this a genuine remediation priority for IBM i environments.
Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low-privileged user to gain unauthorized access to protected data and functionality when the Liberty collectives feature is in use. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable, low-complexity exploitation requiring only low-level authentication with no user interaction - resulting in high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated attacker due to improper validation of module imports, classified under CWE-94 (Code Injection). The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with no user interaction required beyond low-privilege authentication. No public exploit code has been identified at time of analysis, EPSS sits at 0.34% (27th percentile), and SSVC designates exploitation as 'none' currently - though the SSVC technical impact is rated 'total', confirming the severity of successful exploitation.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by remote attackers holding low-privilege credentials via server-side code injection (CWE-94). The CVSS score of 8.8 reflects full confidentiality, integrity, and availability impact with a low-complexity network attack path requiring only valid user authentication. No public exploitation has been confirmed - EPSS places the exploitation probability at 0.36% (29th percentile) and SSVC rates exploitation status as none and the attack as non-automatable, though SSVC's technical impact rating is total, consistent with arbitrary code execution.
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated remote attackers to inject and execute arbitrary Python code by crafting payloads that evade the platform's AST-based security scanning mechanism. The flaw (CWE-94, Code Injection) is particularly insidious because the defensive AST validation layer gives a false sense of protection while silently passing malicious constructs to the Python runtime. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity, fully network-accessible attack path with complete confidentiality, integrity, and availability impact warrants urgent patching - especially for any internet-exposed or multi-tenant deployments.
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege users to trigger arbitrary Python execution on the backend server by submitting crafted Agentic Assistant workflows containing malicious LLM-generated components that are evaluated server-side during validation before user approval is granted. The flaw (CWE-94, Code Injection) arises because the validation pipeline eagerly executes model-generated Python without sandboxing or deferral, giving attackers backend process-level privileges to exfiltrate data, interact with the file system, or initiate outbound network connections. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability at 0.22% (13th percentile), but SSVC rates technical impact as total, making this a high-priority patch target for multi-user or internet-exposed deployments.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows any internet-reachable attacker to execute arbitrary server-side code using only two HTTP requests. The vulnerability is rooted in CWE-94 (Code Injection), enabling full server compromise with no user interaction. A vendor patch is available via IBM advisory, and no public exploit has been identified at time of analysis - however the trivially low attack complexity makes any internet-exposed instance an immediate remediation priority.
Remote code execution in IBM Langflow OSS (versions 1.0.0 through 1.10.3) allows authenticated attackers to execute arbitrary Python code by exploiting a cryptographic weakness (CWE-326) in the custom component validation mechanism. When the optional hardening mode is enabled - the feature intended to restrict execution to trusted component templates - the application validates submitted component code against a truncated SHA-256 digest, making it computationally feasible for an attacker to craft a malicious Python file that collides with a trusted template's hash and bypasses the validation gate entirely. No public exploit code has been identified at time of analysis; a vendor patch is available per IBM advisory, though the exact fixed version is not stated in available data.
Remote code injection in IBM Langflow OSS 1.0.0 through 1.10.3 allows an authenticated remote attacker to execute arbitrary code on the underlying server by supplying malicious input through user-controlled code fields within the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms the attack is network-reachable at low complexity, requiring only low-privilege credentials, with full confidentiality, integrity, and availability impact on the host. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.3 enables authenticated remote attackers to read arbitrary files on the underlying system by submitting URLs containing dot-dot sequences (/../). The CVSS scope change metric (S:C) confirms that exploitation reaches beyond the application's own directory boundary, exposing system-level files such as credentials, configuration, or private keys to any low-privileged account holder. No public exploit code has been identified at time of analysis, though IBM has released a patch via advisory node/7282647.
Cross-user chat history disclosure in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to read other users' conversation history by exploiting session_id collision in the MemoryComponent. The MemoryComponent.retrieve_messages and store_message methods validate only session_id when filtering records, omitting flow_id and user_id ownership checks, which exposes multiple REST API endpoints to unauthorized cross-user data access. No public exploit has been identified at time of analysis, but the straightforward exploitation path and High confidentiality impact make this a genuine remediation priority for any multi-user Langflow deployment.
Broken access control in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to inject arbitrary graph data into the shared execution cache for flows they do not own, via the deprecated POST /api/v1/build/{flow_id}/vertices endpoint. The endpoint performs no ownership validation, enabling cross-user cache pollution that can corrupt other users' workflow state, trigger unauthorized execution of foreign flows, or produce denial of service across a shared platform instance. No public exploit code exists and CISA KEV does not list this vulnerability; EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) collectively indicate low immediate exploitation risk despite the high CVSS score.
Predictable Fernet encryption keys in IBM Langflow OSS 1.0.0 through 1.10.3 allow attackers to decrypt stored API keys and authentication tokens, because when a user secret is shorter than 32 characters the platform derives keys with Python's non-cryptographic `random` (Mersenne Twister) module. Because the Mersenne Twister PRNG is deterministic, identical seeds reproduce identical keys, so an adversary who can reconstruct the seeding conditions can regenerate the key and read every secret Langflow encrypted with it. No public exploit identified at time of analysis; EPSS is low (0.11%) and CISA SSVC records no known exploitation.
Predictable Fernet encryption key generation in IBM Langflow OSS (versions 1.0.0 through 1.10.3) stems from the ensure_fernet_key() function deriving keys from a cryptographically weak source (CWE-338), letting an attacker reconstruct the symmetric key that protects stored secrets such as API keys, credentials, and connection variables. Because the key is guessable rather than random, an actor who can read Langflow's encrypted data store can decrypt it and, depending on how the key is reused, potentially forge or tamper with protected values. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), but IBM rates the flaw CVSS 9.8 and a vendor patch is available.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. No active exploitation confirmed (not in CISA KEV), but the network-accessible, low-complexity attack path and high confidentiality impact (C:H) make this a meaningful internal-network pivot risk for organizations running Langflow with AI provider integration enabled.
OS command injection in IBM Langflow OSS 1.0.0 through 1.10.3 enables remote authenticated attackers to execute arbitrary system commands on the underlying server. The flaw stems from insufficient sanitization of user-supplied input passed to OS-level command execution routines (CWE-78), granting full system-level access with a single authenticated request. No public exploit code has been identified at time of analysis, and CISA does not list this in KEV, though CVSS-assessed technical impact is total across confidentiality, integrity, and availability.
Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.10.3 is reachable by any authenticated low-privileged user who can modify MCP server configurations. Improper validation of the command field in those configurations allows injected shell commands to be executed with the application's process privileges, yielding full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path against a growing AI-tooling platform warrants prompt patching.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated remote attackers to run arbitrary commands by supplying crafted configuration parameters that bypass the application's incomplete input denylist (CWE-184). The flaw carries a CVSS 8.8 score with full confidentiality, integrity, and availability impact, and SSVC rates the technical impact as total. No active exploitation is confirmed - EPSS sits at 0.42% (35th percentile) and the vulnerability is absent from CISA KEV - though the low attack complexity makes it a genuine priority for any internet-exposed Langflow deployment with untrusted authenticated users.
Host filesystem read and write access in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated low-privilege user via insufficient filtering of Docker volume-mount and device-mapping arguments passed to Docker-based MCP servers. By injecting unsanitized flags such as --volume into MCP server configuration, an attacker can bind-mount arbitrary host directories into a spawned container, exposing or tampering with sensitive files outside the intended Docker isolation boundary. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-exploitable, low-complexity attack path and full CIA impact score (CVSS 8.8) make this a high-priority patch target for any organization running Langflow in Docker environments with externally accessible or multi-tenant access.
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.3 exposes the Model Context Protocol (MCP) composer endpoint to unauthenticated remote access when projects are configured with auth_type=oauth and MCP composer is enabled - which is the default deployment state. An unauthenticated network attacker can reach the MCP composer endpoint and read confidential project data (C:H) without supplying valid credentials, entirely bypassing the OAuth authentication gate. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor (IBM) has confirmed the issue and released a patch.
Remote authenticated attackers can bypass localhost-only access restrictions in IBM Langflow OSS 1.0.0 through 1.10.3 to write arbitrary MCP (Model Context Protocol) server configurations to IDE configuration files on the underlying host system. The CVSS scope change (S:C) confirms this escapes the Langflow application boundary, enabling persistent manipulation of developer IDE environments on the host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Server-Side Request Forgery in IBM Application Gateway Operator versions 22.2 through 26.06 lets remote unauthenticated attackers coerce the operator into issuing arbitrary HTTP requests by supplying attacker-controlled URLs in custom resources that the operator fails to validate. Because the operator typically runs inside a Kubernetes/OpenShift cluster, this SSRF can reach internal-only services and cloud metadata endpoints. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and CISA SSVC rates exploitation as none.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Liberty Continuous Delivery allows a malicious or attacker-controlled IIOP server to force a WebSphere client/server to load and instantiate arbitrary Java classes over the network. Exploitation requires no authentication or user interaction (CVSS 9.8), and successful abuse can lead to loss of confidentiality, integrity, and availability, potentially culminating in remote code execution via dangerous class instantiation. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.44% probability of exploitation in the next 30 days.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execute arbitrary code on the underlying host by supplying malicious user-controlled code that is improperly validated (CWE-94). Because Langflow evaluates user-supplied code as part of its low-code AI/agent flow-building functionality, exploitation grants full compromise of the server hosting the application. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.9 with a scope change reflects that a successful attack can break out of the application context to affect other system components.
Cross-tenant vector document disclosure in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privilege user read another user's private Chroma-backed documents by building a flow that reuses the victim's persist_directory and collection_name, returning exact victim content in the attacker's workflow output. The same shared-namespace flaw also lets the attacker write their own documents into the victim's collection, corrupting its integrity. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as none, but the CVSS 8.1 rating reflects the combined high confidentiality and integrity impact.
Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.
OS command injection in the IBM Hardware Management Console (HMC) lets a remote, unauthenticated attacker run arbitrary commands with elevated privileges on the management appliance. It affects HMC V10.3.1050.0 through 10.3.1064.0 and V11.1.1110.0 through 11.1.1112.0, the systems used to manage IBM Power servers (including Novalink deployments), stemming from improper validation of user-supplied input (CWE-78). No public exploit has been identified at time of analysis, but the network-reachable, no-authentication vector and 9.8 CVSS make this a top-priority patch.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sandbox, allowing a low-privileged authenticated user to escape the sandbox and run arbitrary Python. Because the flaw carries a scope-changing CVSS 3.1 score of 9.9 (S:C, C/I/A all High), a successful exploit can compromise the underlying host beyond the intended sandbox boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file read in IBM Langflow OSS versions 1.0.0 through 1.10.1 allows remote unauthenticated attackers to retrieve files outside the intended web root by submitting URLs containing directory-traversal ("../") sequences. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation needs no authentication or user interaction and can expose sensitive files such as configuration, secrets, or source code. No public exploit identified at time of analysis, and there is no indication of active exploitation.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privileged user read and tamper with build jobs belonging to other users by abusing improper access control on log-retrieval and unauthenticated build endpoints. Because Langflow orchestrates LLM/agent workflow builds, a cross-tenant attacker can view sensitive build logs (high confidentiality impact) and interfere with others' jobs (limited availability impact). A vendor patch is available; there is no public exploit identified at time of analysis and the flaw is not on CISA KEV.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary OS commands by injecting shell-control environment variables into the MCP (Model Context Protocol) stdio launcher. The DANGEROUS_ENV_VARS blocklist in src/lfx/src/lfx/base/mcp/util.py omits SHELLOPTS, BASHOPTS, and PS4, letting an attacker abuse Bash's xtrace behavior to execute commands when a stdio-based MCP server subprocess is spawned. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector; a vendor patch is available, but no public exploit code or CISA KEV listing has been identified at the time of analysis.
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.
Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. There is no public exploit identified at time of analysis, but a vendor patch is available from IBM.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled memory consumption in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.7) lets a remote attacker crash or degrade the server by sending a single specially crafted request that forces excessive memory allocation. The flaw is network-reachable and requires no authentication or user interaction (PR:N/UI:N), and IBM (the reporter) has released a fix. There is no public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs because the integration runtime writes potentially sensitive information into log files that any local user can read. An attacker with local access to the host can harvest secrets such as credentials, connection strings, or message payload data from these logs to escalate access or pivot to backend systems. No public exploit identified at time of analysis, and there is no KEV listing; note that the NVD CVSS vector (AV:N) conflicts with the description's explicit 'local user' wording.
Arbitrary code execution in the IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) arises from insecure DLL loading at application start-up, allowing a local low-privileged attacker who can place a malicious DLL in a path the app searches to run code in the context of the launching user. IBM (the reporter and vendor) has published a fix, and there is no public exploit identified at time of analysis. Impact is high to confidentiality, integrity, and availability, but exploitation is gated by local access and the user launching the application.
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.
Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticated attacker write arbitrary files by sending a crafted URL containing '../' sequences. Because attacker-controlled file writes on an integration server can overwrite configuration, deployment artifacts, or executable content, this maps to a full-compromise CVSS 9.8. No public exploit identified at time of analysis, but the vendor (IBM) has released a fix.
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) allows a remote, unauthenticated attacker to retrieve files outside the intended directory via a path traversal flaw (CWE-22), scoring CVSS 7.5. The vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no privileges or user interaction, though impact is confined to confidentiality (C:H/I:N/A:N). There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low-complexity, no-auth profile makes it a straightforward disclosure risk once details are known.
Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.
Cross-site request forgery in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 enables remote attackers to execute unauthorized actions on behalf of authenticated users without their consent. The vulnerability exploits the server's implicit trust in session cookies, allowing a malicious third-party site to trigger state-changing requests against the Liberty instance. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Cross-user information disclosure in IBM Langflow OSS 1.0.0-1.10.1 allows authenticated attackers to access private vector content and poison query results by reusing another user's FAISS namespace. This leads to high confidentiality impact and low integrity impact; the vulnerability has a CVSS 3.1 score of 7.1, and a vendor patch is available.
Sensitive information disclosure in IBM Cloud Pak System 2.3.5.0 allows local attackers to obtain credentials from log files. The CVSS score is 7.5 with a network vector, but the description explicitly states local access, creating ambiguity. No public exploit or active exploitation has been identified at the time of analysis.
Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.
Sensitive information disclosure in IBM WebSphere Application Server 8.5 and 9.0 Traditional allows a remote, unauthenticated attacker to obtain confidential data, assessed by IBM as a High-severity issue (CVSS 7.5). The root cause is CWE-532, indicating that sensitive information is inserted into log files or diagnostic output in a manner accessible to remote actors. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the CVSS vector attributes high confidentiality impact, and a vendor-released patch is available via IBM support.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Arbitrary OS command execution is possible in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) through unquoted shell interpolation, allowing a remote attacker who has already obtained high-privilege authentication to run arbitrary commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:H) confirms network reachability with low attack complexity once authenticated, resulting in full confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via the advisory at https://www.ibm.com/support/pages/node/7280530.
Shell command injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) permits a remote attacker holding high-privilege credentials to execute arbitrary operating system commands on the underlying server. The CVSS 7.2 High score reflects full confidentiality, integrity, and availability impact, substantially gated by the PR:H authentication requirement. No public exploit has been identified at time of analysis, and both EPSS (1.04%, 60th percentile) and CISA SSVC (Exploitation: none) align on low current exploitation activity; a vendor patch is confirmed available.
Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a targeted rather than mass-exploitation risk.
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local authenticated attacker to inject a rogue certificate authority and subsequently intercept or manipulate TLS-protected communications. The writable truststore breaks the chain of trust at the client level, enabling man-in-the-middle attacks against sessions the client believes are cryptographically secured. No public exploit or active exploitation has been identified at time of analysis, and EPSS probability is extremely low at 0.09%.
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Remote code execution in IBM Informix Dynamic Server 14.10, 12.10.x, and 15.0 is possible through a stack-based buffer overflow (CWE-121) in the oninit daemon's sq_sgkprepare function, triggered when processing a SQL interface request containing an unchecked length field. An authenticated, network-adjacent attacker with low-privilege SQL credentials can exploit this to achieve full compromise of the database server, resulting in complete confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; IBM has released a patch via Security Advisory 7283143.
OS command injection in IBM i 7.3 through 7.6 allows a remote authenticated attacker to execute arbitrary operating system commands with the privileges of the affected service. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78), covering all four current IBM i release lines. No public exploit or CISA KEV listing has been identified at time of analysis, but the high CVSS score of 8.8 and full CIA impact triad reflect serious post-authentication risk on a platform commonly used for enterprise workloads.
SQL injection in IBM i (the operating system for IBM Power/AS400 midrange systems) versions 7.3, 7.4, 7.5, and 7.6 lets a remote attacker submit specially crafted SQL statements that reach the back-end database, enabling unauthorized read, insert, modification, or deletion of stored data. IBM assigned a 9.8 CVSS reflecting full confidentiality, integrity, and availability impact, though CISA's SSVC framework rates technical impact only as 'partial' and exploitation as 'none observed.' There is no public exploit identified at time of analysis, and EPSS is low at 0.22% (13th percentile).
Privilege escalation in IBM i 7.3 through 7.6 allows remote authenticated attackers to gain elevated privileges by submitting a crafted, client-supplied profile name that bypasses server-side validation. The root cause is improper privilege management (CWE-269) in profile name handling, enabling an attacker with only low-level authenticated access to escalate to higher system privileges. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and high impact across confidentiality, integrity, and availability make this a serious priority for IBM i environments.
Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 arises from a stack-based buffer overflow that lets a remote attacker run arbitrary code on the host operating system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact to confidentiality, integrity, and availability, scoring 9.8 (Critical). IBM has published a fix, but there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote command injection in IBM i 7.3 through 7.6 allows a network-accessible authenticated attacker to execute arbitrary OS commands by supplying shell metacharacters in unsanitized input, resulting in full confidentiality, integrity, and availability compromise of the affected system. IBM confirmed and patched this vulnerability, documented at https://www.ibm.com/support/pages/node/7283275. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication bar make this a credible threat to any internet-exposed IBM i environment.
Remote code execution in IBM i 7.3 through 7.6 is exploitable by a remote authenticated attacker via improper bounds checking (CWE-787: Out-of-bounds Write). The high integrity impact (I:H) in the CVSS vector confirms that successful exploitation allows an attacker to overwrite memory and achieve arbitrary code execution on the affected IBM Power Systems platform. No public exploit identified at time of analysis, and IBM has released a vendor patch; however, the low-privilege authentication requirement (PR:L) broadens the attacker pool to any valid system user.
Denial of service in IBM i 7.3 through 7.6 allows an unauthenticated remote attacker to crash or render unavailable affected system services by sending input that bypasses server-side size validation. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), and the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no special conditions, and no user interaction. IBM i systems typically host irreplaceable mission-critical business workloads in sectors such as banking and manufacturing, making availability disruption disproportionately impactful despite the absence of code execution; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to run arbitrary code via an out-of-bounds write (CWE-787) memory-corruption flaw. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), indicating unauthenticated network exploitation with no user interaction against affected releases. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so the 9.8 rating reflects potential impact rather than confirmed exploitation.
Privilege escalation to root authority in IBM i 7.3 through 7.6 is achievable by any authenticated low-privileged user via a remote code execution flaw in the activation engine component. The activation engine executes with unnecessary system privileges (CWE-250), allowing a planted malicious script to run with root authority, resulting in full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has released a patch and the low attack complexity makes this a credible near-term threat for unpatched IBM i environments.
Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers with low-privilege credentials to obtain sensitive information across a security scope boundary, yielding a high confidentiality impact. The CVSS vector (S:C/C:H) indicates the leaked data can originate from components outside the attacker's immediate security context - a notable escalation beyond typical information disclosure. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283280.
OS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execute arbitrary operating-system commands on the affected IBM i host by injecting unneutralized special characters into a command the product builds and runs. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact and a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but a vendor patch is available and the low attack complexity makes this a high-priority fix.
Remote code execution in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated attacker to run arbitrary code by abusing an uncontrolled search path element (CWE-427), where a program resolves a library, service program, or executable from an attacker-influenceable location. Because the CVSS scope is changed (S:C), successful exploitation can execute code in a security context beyond the attacker's own low-privileged account, effectively enabling privilege escalation on this enterprise Power-based operating system. IBM has released a fix and there is no public exploit identified at time of analysis, but the 9.9 base score reflects severe impact once a foothold exists.
Remote OS command injection in IBM i 7.5 and 7.6 enables authenticated attackers with low-privilege network access to execute arbitrary commands with elevated system privileges, resulting in complete compromise of confidentiality, integrity, and availability. The flaw (CWE-78) arises from improper neutralization of special characters passed to OS command processing functions without adequate sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and network-accessible attack surface make this a high-priority remediation target for any IBM i deployment.
OS command injection in IBM i 7.5 and 7.6 enables a local attacker holding low-level credentials to escalate privileges to a highly elevated system authority level by injecting shell metacharacters into an unsanitized OS command interface (CWE-78). Both release streams - 7.5 and 7.6 - running on IBM Power Systems hardware are confirmed affected per the IBM advisory. IBM has released a patch via their support portal; no CISA KEV listing and no public exploit code have been identified at time of analysis.
IBM i versions 7.3 through 7.6 expose their TCP/IP stack to a remotely-triggered denial of service when processing zero-length TCP option fields. Classified as CWE-835 (Loop with Unreachable Exit Condition), the flaw causes the TCP stack to enter an infinite or unrecoverable processing loop upon receipt of malformed TCP options, exhausting CPU or thread resources and disrupting hosted business services. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N CVSS vector means any network-reachable IBM i system is exploitable without credentials or special conditions.
Remote authenticated attackers can execute arbitrary commands on IBM i 7.3 through 7.6 by exploiting improper privilege management (CWE-250), achieving full confidentiality, integrity, and availability compromise on affected systems. The CVSS vector of AV:N/AC:L/PR:L/UI:N confirms that only a low-privileged account and network reachability are required - no complex preconditions or user interaction needed. IBM has confirmed the vulnerability and released a patch via advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in IBM i 7.3 through 7.6 enables a local authenticated attacker to cause a denial of service - and potentially achieve broader data confidentiality and integrity impact - by submitting SQL commands containing improperly neutralized special elements. The flaw (CWE-89) is exploitable without user interaction once local access is obtained. No public exploit code has been identified and CISA has not listed this in KEV; a vendor patch is available.
IBM i versions 7.3 through 7.6 expose arbitrary Control Language (CL) command execution to remote authenticated attackers through insufficient input validation in a network-accessible interface. Any low-privileged IBM i user account is sufficient to exploit this flaw, enabling high-impact compromise of confidentiality and integrity on the affected system. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad version range across currently supported IBM i releases make this a meaningful patching priority for affected enterprises.
Privilege escalation in IBM i (formerly OS/400) releases 7.3 through 7.6 lets a remote authenticated user with low privileges gain higher, potentially all-object, authority by abusing improper authorization checks in the handling of high-authority threads. The flaw is scored CVSS 9.9 because of a scope change (S:C) that lets a foothold on the platform lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS is low at 0.24%, but a vendor patch is available.
Privilege escalation in IBM i versions 7.3 through 7.6 via the Navigator for i web-based administration interface allows an authenticated low-privileged user to elevate their session to root and execute arbitrary commands on the system. The CVSS 3.1 score of 8.8 (PR:L, AV:N, AC:L) reflects that exploitation requires only valid credentials and network access to the Navigator for i interface, with full confidentiality, integrity, and availability impact upon success. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote authenticated command execution in IBM i 7.3 through 7.6 stems from improper privilege management during monitor owner reassignment, a specific system management function. An attacker holding low-privileged credentials can exploit this flaw over the network without user interaction to execute arbitrary commands, achieving both high confidentiality and high integrity impact on the affected system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and authentication barrier make this a credible threat in any environment with broad user access to IBM i.
Credential harvesting in IBM i (via its Navigator for i web administration console) allows a remote unauthenticated attacker to spoof the legitimate Navigator for i interface and trick operators into disclosing their credentials, per IBM's advisory covering releases 7.6, 7.5, 7.4, and 7.3. The flaw is a CWE-346 origin-validation weakness carrying a CVSS 9.8 rating, though real-world exploitation signals are modest - there is no public exploit identified at time of analysis and EPSS sits at just 0.18% (7th percentile). A vendor patch is available.
Path traversal in IBM i 7.3 through 7.6 allows remote authenticated attackers to read sensitive files and write or manipulate files outside intended directory boundaries. The vulnerability is reachable over the network with only low-privilege credentials, making it accessible to a broad set of authenticated users in multi-tenant or shared IBM i environments. No active exploitation or public proof-of-concept has been identified at time of analysis, and IBM has released a patch via their support portal.
Security restriction bypass in IBM i 7.3 through 7.6 enables remote authenticated attackers to elevate privileges via unsafe Java reflection (CWE-915), allowing dynamic modification of object attributes in ways the platform's access control layer does not anticipate. The CVSS 8.3 score reflects network reachability, low attack complexity, and high confidentiality and integrity impact - meaning any valid low-privilege account can exploit this without user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low barrier to exploitation (PR:L, AC:L) makes this a credible lateral-movement or privilege-escalation path in IBM i shops.
XML injection in IBM i versions 7.3 through 7.6 enables a remote low-privileged authenticated attacker to exfiltrate sensitive information and compromise system integrity without disrupting availability. The CVSS 8.1 High score reflects a network-accessible, low-complexity attack path requiring only a standard user account. No public exploit has been identified at time of analysis; a vendor-released patch is available via IBM's support portal.
Privilege escalation via OS command injection in IBM i Navigator for i (versions 7.3 through 7.6) allows any authenticated, low-privileged network user to execute arbitrary OS commands as the root user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms this is a low-complexity, network-accessible exploit requiring only a valid user account - no additional privileges or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full CIA impact make this a genuine remediation priority for IBM i environments.
Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low-privileged user to gain unauthorized access to protected data and functionality when the Liberty collectives feature is in use. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable, low-complexity exploitation requiring only low-level authentication with no user interaction - resulting in high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated attacker due to improper validation of module imports, classified under CWE-94 (Code Injection). The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with no user interaction required beyond low-privilege authentication. No public exploit code has been identified at time of analysis, EPSS sits at 0.34% (27th percentile), and SSVC designates exploitation as 'none' currently - though the SSVC technical impact is rated 'total', confirming the severity of successful exploitation.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by remote attackers holding low-privilege credentials via server-side code injection (CWE-94). The CVSS score of 8.8 reflects full confidentiality, integrity, and availability impact with a low-complexity network attack path requiring only valid user authentication. No public exploitation has been confirmed - EPSS places the exploitation probability at 0.36% (29th percentile) and SSVC rates exploitation status as none and the attack as non-automatable, though SSVC's technical impact rating is total, consistent with arbitrary code execution.
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated remote attackers to inject and execute arbitrary Python code by crafting payloads that evade the platform's AST-based security scanning mechanism. The flaw (CWE-94, Code Injection) is particularly insidious because the defensive AST validation layer gives a false sense of protection while silently passing malicious constructs to the Python runtime. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity, fully network-accessible attack path with complete confidentiality, integrity, and availability impact warrants urgent patching - especially for any internet-exposed or multi-tenant deployments.
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege users to trigger arbitrary Python execution on the backend server by submitting crafted Agentic Assistant workflows containing malicious LLM-generated components that are evaluated server-side during validation before user approval is granted. The flaw (CWE-94, Code Injection) arises because the validation pipeline eagerly executes model-generated Python without sandboxing or deferral, giving attackers backend process-level privileges to exfiltrate data, interact with the file system, or initiate outbound network connections. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability at 0.22% (13th percentile), but SSVC rates technical impact as total, making this a high-priority patch target for multi-user or internet-exposed deployments.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows any internet-reachable attacker to execute arbitrary server-side code using only two HTTP requests. The vulnerability is rooted in CWE-94 (Code Injection), enabling full server compromise with no user interaction. A vendor patch is available via IBM advisory, and no public exploit has been identified at time of analysis - however the trivially low attack complexity makes any internet-exposed instance an immediate remediation priority.
Remote code execution in IBM Langflow OSS (versions 1.0.0 through 1.10.3) allows authenticated attackers to execute arbitrary Python code by exploiting a cryptographic weakness (CWE-326) in the custom component validation mechanism. When the optional hardening mode is enabled - the feature intended to restrict execution to trusted component templates - the application validates submitted component code against a truncated SHA-256 digest, making it computationally feasible for an attacker to craft a malicious Python file that collides with a trusted template's hash and bypasses the validation gate entirely. No public exploit code has been identified at time of analysis; a vendor patch is available per IBM advisory, though the exact fixed version is not stated in available data.
Remote code injection in IBM Langflow OSS 1.0.0 through 1.10.3 allows an authenticated remote attacker to execute arbitrary code on the underlying server by supplying malicious input through user-controlled code fields within the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms the attack is network-reachable at low complexity, requiring only low-privilege credentials, with full confidentiality, integrity, and availability impact on the host. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.3 enables authenticated remote attackers to read arbitrary files on the underlying system by submitting URLs containing dot-dot sequences (/../). The CVSS scope change metric (S:C) confirms that exploitation reaches beyond the application's own directory boundary, exposing system-level files such as credentials, configuration, or private keys to any low-privileged account holder. No public exploit code has been identified at time of analysis, though IBM has released a patch via advisory node/7282647.
Cross-user chat history disclosure in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to read other users' conversation history by exploiting session_id collision in the MemoryComponent. The MemoryComponent.retrieve_messages and store_message methods validate only session_id when filtering records, omitting flow_id and user_id ownership checks, which exposes multiple REST API endpoints to unauthorized cross-user data access. No public exploit has been identified at time of analysis, but the straightforward exploitation path and High confidentiality impact make this a genuine remediation priority for any multi-user Langflow deployment.
Broken access control in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to inject arbitrary graph data into the shared execution cache for flows they do not own, via the deprecated POST /api/v1/build/{flow_id}/vertices endpoint. The endpoint performs no ownership validation, enabling cross-user cache pollution that can corrupt other users' workflow state, trigger unauthorized execution of foreign flows, or produce denial of service across a shared platform instance. No public exploit code exists and CISA KEV does not list this vulnerability; EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) collectively indicate low immediate exploitation risk despite the high CVSS score.
Predictable Fernet encryption keys in IBM Langflow OSS 1.0.0 through 1.10.3 allow attackers to decrypt stored API keys and authentication tokens, because when a user secret is shorter than 32 characters the platform derives keys with Python's non-cryptographic `random` (Mersenne Twister) module. Because the Mersenne Twister PRNG is deterministic, identical seeds reproduce identical keys, so an adversary who can reconstruct the seeding conditions can regenerate the key and read every secret Langflow encrypted with it. No public exploit identified at time of analysis; EPSS is low (0.11%) and CISA SSVC records no known exploitation.
Predictable Fernet encryption key generation in IBM Langflow OSS (versions 1.0.0 through 1.10.3) stems from the ensure_fernet_key() function deriving keys from a cryptographically weak source (CWE-338), letting an attacker reconstruct the symmetric key that protects stored secrets such as API keys, credentials, and connection variables. Because the key is guessable rather than random, an actor who can read Langflow's encrypted data store can decrypt it and, depending on how the key is reused, potentially forge or tamper with protected values. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), but IBM rates the flaw CVSS 9.8 and a vendor patch is available.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. No active exploitation confirmed (not in CISA KEV), but the network-accessible, low-complexity attack path and high confidentiality impact (C:H) make this a meaningful internal-network pivot risk for organizations running Langflow with AI provider integration enabled.
OS command injection in IBM Langflow OSS 1.0.0 through 1.10.3 enables remote authenticated attackers to execute arbitrary system commands on the underlying server. The flaw stems from insufficient sanitization of user-supplied input passed to OS-level command execution routines (CWE-78), granting full system-level access with a single authenticated request. No public exploit code has been identified at time of analysis, and CISA does not list this in KEV, though CVSS-assessed technical impact is total across confidentiality, integrity, and availability.
Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.10.3 is reachable by any authenticated low-privileged user who can modify MCP server configurations. Improper validation of the command field in those configurations allows injected shell commands to be executed with the application's process privileges, yielding full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path against a growing AI-tooling platform warrants prompt patching.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated remote attackers to run arbitrary commands by supplying crafted configuration parameters that bypass the application's incomplete input denylist (CWE-184). The flaw carries a CVSS 8.8 score with full confidentiality, integrity, and availability impact, and SSVC rates the technical impact as total. No active exploitation is confirmed - EPSS sits at 0.42% (35th percentile) and the vulnerability is absent from CISA KEV - though the low attack complexity makes it a genuine priority for any internet-exposed Langflow deployment with untrusted authenticated users.
Host filesystem read and write access in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated low-privilege user via insufficient filtering of Docker volume-mount and device-mapping arguments passed to Docker-based MCP servers. By injecting unsanitized flags such as --volume into MCP server configuration, an attacker can bind-mount arbitrary host directories into a spawned container, exposing or tampering with sensitive files outside the intended Docker isolation boundary. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-exploitable, low-complexity attack path and full CIA impact score (CVSS 8.8) make this a high-priority patch target for any organization running Langflow in Docker environments with externally accessible or multi-tenant access.
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.3 exposes the Model Context Protocol (MCP) composer endpoint to unauthenticated remote access when projects are configured with auth_type=oauth and MCP composer is enabled - which is the default deployment state. An unauthenticated network attacker can reach the MCP composer endpoint and read confidential project data (C:H) without supplying valid credentials, entirely bypassing the OAuth authentication gate. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor (IBM) has confirmed the issue and released a patch.
Remote authenticated attackers can bypass localhost-only access restrictions in IBM Langflow OSS 1.0.0 through 1.10.3 to write arbitrary MCP (Model Context Protocol) server configurations to IDE configuration files on the underlying host system. The CVSS scope change (S:C) confirms this escapes the Langflow application boundary, enabling persistent manipulation of developer IDE environments on the host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Server-Side Request Forgery in IBM Application Gateway Operator versions 22.2 through 26.06 lets remote unauthenticated attackers coerce the operator into issuing arbitrary HTTP requests by supplying attacker-controlled URLs in custom resources that the operator fails to validate. Because the operator typically runs inside a Kubernetes/OpenShift cluster, this SSRF can reach internal-only services and cloud metadata endpoints. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and CISA SSVC rates exploitation as none.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Liberty Continuous Delivery allows a malicious or attacker-controlled IIOP server to force a WebSphere client/server to load and instantiate arbitrary Java classes over the network. Exploitation requires no authentication or user interaction (CVSS 9.8), and successful abuse can lead to loss of confidentiality, integrity, and availability, potentially culminating in remote code execution via dangerous class instantiation. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.44% probability of exploitation in the next 30 days.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execute arbitrary code on the underlying host by supplying malicious user-controlled code that is improperly validated (CWE-94). Because Langflow evaluates user-supplied code as part of its low-code AI/agent flow-building functionality, exploitation grants full compromise of the server hosting the application. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.9 with a scope change reflects that a successful attack can break out of the application context to affect other system components.
Cross-tenant vector document disclosure in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privilege user read another user's private Chroma-backed documents by building a flow that reuses the victim's persist_directory and collection_name, returning exact victim content in the attacker's workflow output. The same shared-namespace flaw also lets the attacker write their own documents into the victim's collection, corrupting its integrity. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as none, but the CVSS 8.1 rating reflects the combined high confidentiality and integrity impact.
Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.
OS command injection in the IBM Hardware Management Console (HMC) lets a remote, unauthenticated attacker run arbitrary commands with elevated privileges on the management appliance. It affects HMC V10.3.1050.0 through 10.3.1064.0 and V11.1.1110.0 through 11.1.1112.0, the systems used to manage IBM Power servers (including Novalink deployments), stemming from improper validation of user-supplied input (CWE-78). No public exploit has been identified at time of analysis, but the network-reachable, no-authentication vector and 9.8 CVSS make this a top-priority patch.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sandbox, allowing a low-privileged authenticated user to escape the sandbox and run arbitrary Python. Because the flaw carries a scope-changing CVSS 3.1 score of 9.9 (S:C, C/I/A all High), a successful exploit can compromise the underlying host beyond the intended sandbox boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file read in IBM Langflow OSS versions 1.0.0 through 1.10.1 allows remote unauthenticated attackers to retrieve files outside the intended web root by submitting URLs containing directory-traversal ("../") sequences. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation needs no authentication or user interaction and can expose sensitive files such as configuration, secrets, or source code. No public exploit identified at time of analysis, and there is no indication of active exploitation.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privileged user read and tamper with build jobs belonging to other users by abusing improper access control on log-retrieval and unauthenticated build endpoints. Because Langflow orchestrates LLM/agent workflow builds, a cross-tenant attacker can view sensitive build logs (high confidentiality impact) and interfere with others' jobs (limited availability impact). A vendor patch is available; there is no public exploit identified at time of analysis and the flaw is not on CISA KEV.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary OS commands by injecting shell-control environment variables into the MCP (Model Context Protocol) stdio launcher. The DANGEROUS_ENV_VARS blocklist in src/lfx/src/lfx/base/mcp/util.py omits SHELLOPTS, BASHOPTS, and PS4, letting an attacker abuse Bash's xtrace behavior to execute commands when a stdio-based MCP server subprocess is spawned. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector; a vendor patch is available, but no public exploit code or CISA KEV listing has been identified at the time of analysis.
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.
Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. There is no public exploit identified at time of analysis, but a vendor patch is available from IBM.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled memory consumption in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.7) lets a remote attacker crash or degrade the server by sending a single specially crafted request that forces excessive memory allocation. The flaw is network-reachable and requires no authentication or user interaction (PR:N/UI:N), and IBM (the reporter) has released a fix. There is no public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs because the integration runtime writes potentially sensitive information into log files that any local user can read. An attacker with local access to the host can harvest secrets such as credentials, connection strings, or message payload data from these logs to escalate access or pivot to backend systems. No public exploit identified at time of analysis, and there is no KEV listing; note that the NVD CVSS vector (AV:N) conflicts with the description's explicit 'local user' wording.
Arbitrary code execution in the IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) arises from insecure DLL loading at application start-up, allowing a local low-privileged attacker who can place a malicious DLL in a path the app searches to run code in the context of the launching user. IBM (the reporter and vendor) has published a fix, and there is no public exploit identified at time of analysis. Impact is high to confidentiality, integrity, and availability, but exploitation is gated by local access and the user launching the application.
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.
Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticated attacker write arbitrary files by sending a crafted URL containing '../' sequences. Because attacker-controlled file writes on an integration server can overwrite configuration, deployment artifacts, or executable content, this maps to a full-compromise CVSS 9.8. No public exploit identified at time of analysis, but the vendor (IBM) has released a fix.
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) allows a remote, unauthenticated attacker to retrieve files outside the intended directory via a path traversal flaw (CWE-22), scoring CVSS 7.5. The vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no privileges or user interaction, though impact is confined to confidentiality (C:H/I:N/A:N). There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low-complexity, no-auth profile makes it a straightforward disclosure risk once details are known.
Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.
Cross-site request forgery in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 enables remote attackers to execute unauthorized actions on behalf of authenticated users without their consent. The vulnerability exploits the server's implicit trust in session cookies, allowing a malicious third-party site to trigger state-changing requests against the Liberty instance. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Cross-user information disclosure in IBM Langflow OSS 1.0.0-1.10.1 allows authenticated attackers to access private vector content and poison query results by reusing another user's FAISS namespace. This leads to high confidentiality impact and low integrity impact; the vulnerability has a CVSS 3.1 score of 7.1, and a vendor patch is available.
Sensitive information disclosure in IBM Cloud Pak System 2.3.5.0 allows local attackers to obtain credentials from log files. The CVSS score is 7.5 with a network vector, but the description explicitly states local access, creating ambiguity. No public exploit or active exploitation has been identified at the time of analysis.
Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.
Sensitive information disclosure in IBM WebSphere Application Server 8.5 and 9.0 Traditional allows a remote, unauthenticated attacker to obtain confidential data, assessed by IBM as a High-severity issue (CVSS 7.5). The root cause is CWE-532, indicating that sensitive information is inserted into log files or diagnostic output in a manner accessible to remote actors. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the CVSS vector attributes high confidentiality impact, and a vendor-released patch is available via IBM support.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Arbitrary OS command execution is possible in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) through unquoted shell interpolation, allowing a remote attacker who has already obtained high-privilege authentication to run arbitrary commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:H) confirms network reachability with low attack complexity once authenticated, resulting in full confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via the advisory at https://www.ibm.com/support/pages/node/7280530.
Shell command injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) permits a remote attacker holding high-privilege credentials to execute arbitrary operating system commands on the underlying server. The CVSS 7.2 High score reflects full confidentiality, integrity, and availability impact, substantially gated by the PR:H authentication requirement. No public exploit has been identified at time of analysis, and both EPSS (1.04%, 60th percentile) and CISA SSVC (Exploitation: none) align on low current exploitation activity; a vendor patch is confirmed available.
Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.