EUVD-2026-119748

IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

CVE-2026-118904

IBM webMethods Integration Server version 12.1 is vulnerable to an improper authentication flaw (CWE-287 ) during 2FA Authentication due to a vulnerability in backup code validation . A remote authenticated attacker can exploit this to bypass security restrictions, potentially leading to high con...

CVE-2026-117545

IBM webMethods Integration Server 12.1 is vulnerable to a security bypass involving the two-factor authentication mechanism . Due to improper authentication (CWE-287), a remote authenticated attacker could bypass security restrictions. This vulnerability has a CVSS base score of 8.8, indicating h...

EUVD-2026-119682

IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

PT-2026-140154

IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

PT-2026-140044

IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

Security Bulletin: IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication. CVE-2026-118904

Summary IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication. CVE-2026-118904 Vulnerability Details ID: CVE-2026-118904 DESCRIPTION: IBM webMethods Integration on prem could allow a remote authenticated attacker to bypass security...

Security Bulletin: IBM webMethods Integration Server is vulnerable of bypassing the two-factor authentication mechanism. CVE-2026-117545

Summary IBM webMethods Integration Server is vulnerable of bypassing the two-factor authentication mechanism. CVE-2026-117545 Vulnerability Details ID: CVE-2026-117545 DESCRIPTION: IBM webMethods Integration on prem could allow a remote authenticated attacker to bypass security restrictions due t...

Security Bulletin: Due to the use of Apache Avro, IBM webMethods Integration Server is vulnerable to CVE-2025-33042

Summary Due to the use of Apache Avro, IBM webMethods Integration Server is vulnerable to CVE-2025-33042 Vulnerability Details CVEID:CVE-2025-33042 DESCRIPTION: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Avro Java SDK when generating specific records from...

Security Bulletin: IBM webMethods Integration Server uses third-party Apache MINA SSHD and Apache MINA Core libraries that are affected CVE-2026-56624

Summary IBM webMethods Integration Server uses third-party Apache MINA SSHD and Apache MINA Core libraries that are affected by CVE-2026-56624. Vulnerability Details CVEID:CVE-2026-56624 DESCRIPTION: Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java libra...

Security Bulletin: IBM webMethods Integration Sever is affected by multiple CVEs related to Bouncy Castle for Java FIPS jars

Summary IBM webMethods Integration Sever uses third party Bouncy Castle for Java FIPS jars that are affected by multiple CVEs. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X...

CVE-2026-2310: XML Injection (aka Blind XPath Injection)

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-14289: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

EUVD-2025-18657

Malicious code in bioql PyPI...

CVE-2025-36049 IBM webMethods Integration Sever XML external entity injection

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands...

CVE-2025-36049

IBM webMethods Integration Server (on‑prem) versions 10.5, 10.7, 10.11, and 10.15 are affected by CVE-2025-36049 due to an XML external entity (XXE) processing vulnerability in XML data handling. The underlying issue is XXE which could allow a remote authenticated attacker to execute arbitrary co...

CVE-2025-36049 IBM webMethods Integration Sever XML external entity injection

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands...

CVE-2025-36048 IBM webMethods Integration Sever code execution

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges...

CVE-2025-36048 IBM webMethods Integration Sever code execution

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges...

CVE-2025-36048

CVE-2025-36048 affects IBM webMethods Integration Server (on‑prem) versions 10.5, 10.7, 10.11, and 10.15. The root cause is execution with unnecessary privileges when handling external entities, enabling a privileged user to escalate privileges. The IBM bulletin specifies affected builds and fixe...