CVE-2026-1030

CVE-2026-1030 affects IBM Common Licensing (Agent 9.0, 9.0.0.1, 9.0.0.2; ART 9.0, 9.0.0.1, 9.0.0.2), which generates error messages containing sensitive information about its environment, users, or associated data (CWE-209). The vulnerability requires low privileges and no user interaction, with ...

CVE-2026-1029

CVE-2026-1029 affects IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, and 9.0.0.2 (also identified as IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent ). The vulnerability is a cross-site scripting (XSS) flaw that allows users to embed ...

CVE-2026-1029 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

EUVD-2026-83135

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2026-1025

IBM Common Licensing (Agent 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2) contains a cross-site scripting flaw (CWE-79) in its Web UI. An attacker can embed arbitrary JavaScript code that alters intended functionality, potentially leading to credentials disclosure within a trusted...

CVE-2026-10030 IBM MQ Console is vulnerable to privilege escalation

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

CVE-2026-10030

IBM MQ versions 9.3 LTS, 9.4 LTS, 9.3 CD, 9.4 CD, and 10.0.0.0 are affected by an improper authorization flaw (CWE-285) in the REST API and Console component. An authenticated non-administrative user with only read-only console access can create and start queue managers on the host, leading to pr...

EUVD-2026-83131

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

EUVD-2026-83129

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled...

CVE-2026-10027

IBM MQ queue manager (versions 9.1.0.0 through 10.0.0.0) and IBM MQ Appliance (9.4 LTS/CD and 10.0) are vulnerable to an unauthenticated remote code execution flaw caused by a heap out-of-bounds write (CWE-787) in the message decompression handler. A remote attacker with network access to the lis...

EUVD-2025-210960

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36421

IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 are affected by a cleartext transmission vulnerability (CWE-319 ). The product transmits data without encryption, allowing an attacker positioned between the client and server to intercept and obtain sensitive informa...

CVE-2025-36178 Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size...

CVE-2025-36178

IBM Controller (also known as IBM Cognos Controller) versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 are affected by an improper validation of client-side file size input (CWE-1284). An authenticated user can exploit this to bypass input validation, resulting in low integrity and...

EUVD-2025-210959

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size...

CVE-2025-36147

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.16 are vulnerable to cross-site scripting (CWE-79) . The root cause is that the security configuration lacks specific content security directives , relying instead on a broad fallback policy in ...

CVE-2025-36076

IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 are affected by a vulnerability where sensitive information is stored in source code (CWE-540). An authenticated user can access this information, potentially using it in further attacks against the system. The ...

EUVD-2025-210957

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system...

CVE-2025-36076 IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system...

CVE-2025-36045

IBM TS4300 Tape Library (versions 1.1.0.1 through 1.7.1.1) is affected by a denial-of-service vulnerability in its email service. Email-related functions in the web GUI and APIs did not enforce rate limiting, allowing an authenticated user to repeatedly invoke email-sending requests and generate ...