380
CVEs
64
Critical
177
High
0
KEV
4
PoC
55
Unpatched C/H
79.2%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
64
HIGH
177
MEDIUM
128
LOW
6
Monthly CVE Trend
Affected Products (30)
Websphere Application Server
282
Aix
234
Db2
227
Sterling B2b Integrator
153
Maximo Asset Management
149
Infosphere Information Server
145
Qradar Security Information And Event Manager
130
Vios
124
Websphere Portal
105
Langflow Oss
102
Rational Doors Next Generation
99
Rational Quality Manager
95
Powervm Vios
95
Java
93
Sterling File Gateway
86
Rational Engineering Lifecycle Manager
84
Rational Team Concert
84
Security Guardium
81
Security Verify Access
77
Business Process Manager
76
Open Redirect
70
Rational Collaborative Lifecycle Management
68
Cognos Analytics
65
Smartcloud Control Desk
62
Security Key Lifecycle Manager
58
Websphere Mq
54
Rational Rhapsody Design Manager
54
Concert
53
Api Connect
53
Windows
52
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19295 | Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV. | CRITICAL | 9.9 | 1.0% | 85 |
PoC
|
| CVE-2026-18729 | Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis. | HIGH | 8.8 | 0.5% | 79 |
PoC
|
| CVE-2026-12944 | Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list. | CRITICAL | 9.6 | – | 68 |
PoC
No patch
|
| CVE-2026-16335 | A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis. | HIGH | 8.1 | – | 60 |
PoC
|
| CVE-2026-15068 | OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands through the Network Installation Manager (NIM) component. Because NIM typically operates with high (often root-level) privilege and the CVSS scope is Changed, successful exploitation can compromise the underlying operating system with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.9 base score and low attack complexity make it a high-priority patch for IBM Power estates. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-16816 | OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). Rated CVSS 9.9 with a scope change, a successful low-privilege attacker can break out of the application context and run commands on the underlying enterprise Unix host, threatening confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and network reachability make it a high-priority patch. | CRITICAL | 9.9 | 0.8% | 50 |
|
| CVE-2026-18835 | OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker run arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). IBM PSIRT rates it CVSS 9.9 with a scope change, reflecting that an authenticated foothold can be escalated into full host compromise across the confidentiality, integrity, and availability dimensions. No public exploit identified at time of analysis and it is not listed in CISA KEV, so the current threat is potential rather than confirmed in-the-wild activity. | CRITICAL | 9.9 | 0.8% | 50 |
No patch
|
| CVE-2026-17142 | Improper authentication in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, allows a remote attacker to execute arbitrary commands on affected systems. The flaw carries a critical CVSS 9.8 rating (network-reachable, no privileges or user interaction) and, per IBM's own PSIRT advisory, an authentication bypass can lead to full command execution. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.9% | 50 |
No patch
|
| CVE-2026-16882 | Remote OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network attacker to execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and IBM has published a fix. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of unauthenticated remote code execution on enterprise UNIX and virtualization infrastructure makes this a high-priority patch. | CRITICAL | 9.8 | 0.9% | 50 |
|
| CVE-2026-16845 | Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue. | CRITICAL | 9.8 | 0.8% | 50 |
|
| CVE-2026-16862 | Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping. | CRITICAL | 9.8 | 0.8% | 50 |
|
| CVE-2026-16864 | Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.8% | 50 |
|
| CVE-2026-16872 | Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow (CWE-121) that a network attacker can trigger without authentication or user interaction. Because the flaw carries a CVSS 9.8 with an AV:N/AC:L/PR:N/UI:N vector, a successful attack yields full compromise of confidentiality, integrity, and availability on affected enterprise UNIX hosts and virtualization I/O servers. There is no public exploit identified at time of analysis, and IBM (the reporter) has released a fix. | CRITICAL | 9.8 | 0.8% | 50 |
|
| CVE-2026-16885 | Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run arbitrary code by triggering a stack-based buffer overflow, per the vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N. IBM (the reporting party) has published a fix, and no public exploit identified at time of analysis. EPSS and KEV signals were not provided, so the 9.8 CVSS score is currently the strongest available severity indicator. | CRITICAL | 9.8 | 0.8% | 50 |
|
| CVE-2026-16894 | Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV. | CRITICAL | 9.8 | 0.8% | 50 |
No patch
|