CVE-2026-84031

IBM Guardium Data Protection 12.2 is vulnerable to a Cross-site Scripting (CWE-79) flaw caused by improper neutralization of input during web page generation. A remote authenticated attacker could exploit this to execute arbitrary code on the affected appliance, with changed scope impacting confi...

CVE-2026-82896

IBM Guardium Data Protection 12.2 is affected by a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to traverse directories on the system. The vulnerability carries a CVSS 3.1 score of 7.6 (HIGH) with low confidentiality impact, high integrity impact, and low avai...

CVE-2026-82893

IBM Guardium Data Protection 12.2 is affected by an improper privilege management flaw that allows a local attacker with low privileges to gain elevated privileges without user interaction. The vulnerability is scored CVSS 7.8 (HIGH) with full impact on confidentiality, integrity, and availabilit...

CVE-2026-82892

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection caused by improper neutralization of special elements in an OS command, allowing a remote attacker to execute arbitrary commands. The flaw requires no prior authentication or user interaction but has a high attack complexity ...

CVE-2026-82890

IBM Guardium Data Protection 12.2 is vulnerable to improper neutralization of input during web page generation , allowing a remote authenticated attacker to execute arbitrary JavaScript code . The CVSS 3.1 score is 5.9 (MEDIUM) , with high attack complexity and low privileges required. No specifi...

CVE-2026-82887

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection due to improper neutralization of special elements used in an OS command. A remote authenticated attacker (low privileges required) can execute arbitrary commands, leading to high impact on confidentiality, integrity, and ava...

CVE-2026-82340

IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener . A remote network attacker who can reach TCP port 16017 may submit crafted serialized messages, potentially cau...

CVE-2026-81937

IBM Guardium Data Protection 12.2 contains a command injection vulnerability (CWE-78) in the import remotelog_config CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter , potentially achieving arbitrary command execution with root privilege...

CVE-2026-81933

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the Analytic Grid Service Handler . A low-privileged authenticated user can inject SQL statements via the analytic cases grid endpoint, potentially leading to unauthorized access to sensitive data and impact to confidentiality, i...

CVE-2026-81669

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inject arbitrary shell commands through the alias input , achieving command execution with root privileges . The CVSS 3.1 score is 7....

CVE-2026-81657

IBM Guardium Data Protection 12.2 is vulnerable to deserialization of untrusted data (CWE-502), allowing a remote unauthenticated attacker to execute arbitrary code on the system. The vulnerability is rated CRITICAL with a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This CVE is ...

CVE-2026-81656

IBM Guardium Data Protection 12.2 is affected by a SQL injection (CWE-89) in the New Query Builder REST Processor . A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially leading to unauthorized data access and impact to confidentialit...

CVE-2026-81626

IBM Guardium Data Protection 12.2 is affected by a SQL injection vulnerability (CWE-89) in the Load Balancer Groups component . An unauthenticated attacker can inject SQL statements through the Load Balancer Servlet endpoint over the network, requiring no user interaction or prior authentication....

CVE-2026-81623

IBM Guardium Data Protection 12.2 is affected by improper validation of user-supplied input, which allows an authenticated user with low privileges to execute arbitrary commands on the system. The CVSS 3.1 base score is 6.3 (MEDIUM) with a network attack vector, low complexity, and low impact to ...

CVE-2026-80442

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection in the exportCertificate functionality. A low-privilege attacker with network access can execute unauthorized commands, impacting confidentiality, integrity, and availability of the affected system. The CVSS ...

CVE-2026-80441

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker can inject malicious SQL that is subsequently processed by the application, potentially compromising the confiden...

CVE-2026-75878

IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 allow a remote attacker to bypass authentication and obtain a fully authenticated session by sending an unvalidated SSO header (CWE-287: Improper Authentication). The vulnerability i...

CVE-2026-18869

IBM i versions 7.3 through 7.6 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the FTP service. Improper validation of PORT and EPRT commands allows a remote authenticated attacker to bypass security restrictions and access internal network services . The CVSS 3.1 base score...

CVE-2026-17619

IBM Platform RTM (spectrum-lsf) versions 10.2.0.15 and 10.2.0.16 are affected by a SQL injection vulnerability (CWE-89). The application accepts user input directly in a web interface for SQL queries without adequate validation, allowing a remote attacker to send specially crafted SQL statements ...

CVE-2026-17262

IBM i versions 7.3 through 7.6 are vulnerable to denial of service and security restriction bypass due to improper validation of FTP authentication commands (CWE-78, OS Command Injection). A local attacker on an adjacent network with no required privileges can exploit this with low complexity, re...