CVE-2026-80380: Cross-Site Request Forgery (CSRF)

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery...

CVE-2026-82098: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

PT-2026-89619

🚨 CVE-2026-79742 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist. 🎖@cveNotify...

PT-2026-89614

🚨 CVE-2026-78575 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration. 🎖@cveNotify...

CVE-2026-82095: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-78569: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...

CVE-2026-85025: Incorrect Authorization

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls...

PT-2026-89631

🚨 CVE-2026-81268 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation. 🎖@cveNotify...

CVE-2026-9336: Missing Authentication for Critical Function

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space...

PT-2026-89612

🚨 CVE-2026-78571 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input. 🎖@cveNotify...

PT-2026-89621

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery...

CVE-2026-2310: XML Injection (aka Blind XPath Injection)

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-75777: Improper Privilege Management

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...

PT-2026-89598

🚨Critical - IBM Langflow OSS Unauth RCE via Public MCP Project Endpoints CVE-2026-85025 Langflow OSS improperly enforces public-flow restrictions on publicly shared MCP project endpoints, allowing unauthenticated access to/modify chat sessions. By abusing weak session isolation, attackers can piv...

CVE-2026-76059: Protection Mechanism Failure

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...

CVE-2026-80436: Improper Authorization

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization...

PT-2026-89617

🚨 CVE-2026-79724 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command. 🎖@cveNotify...

PT-2026-89648

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

PT-2026-89633

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-89629

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...