100760 matches found
CVE-2026-17057: Missing Authentication for Critical Function
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions...
CVE-2026-19645: Uncontrolled Resource Consumption
IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When...
CVE-2026-18887: Exposure of Sensitive Information to an Unauthorized Actor
IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about process they shouldn't be permitted to access...
PT-2026-85765
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow...
PT-2026-85763
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...
CVE-2026-17621: Improper Limitation of a Pathname to a Restricted Directory
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...
PT-2026-85662
🚨 HIGH Severity Alert CVE-2026-81832 | CVSS 7.7 IBM App Connect Enterprise & Integration Bus vulnerable to XXE attack allowing confidential data exposure. Affected: ACE 12.0.1.0-12.0.12.28, 13.0.1.0-13.0.8.1 & IB for z/OS 10.1.0.0-10.1.0.7 https://t.co/Iln5WlecgQ...
CVE-2026-17444: Improper Restriction of XML External Entity Reference
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...
CVE-2026-18567: Time-of-check Time-of-use (TOCTOU) Race Condition
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...
CVE-2026-17627: Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...
PT-2026-85695
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process...
PT-2026-85757
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow...
PT-2026-85756
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow...
PT-2026-85762
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection flaw...
PT-2026-85743
IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack...
PT-2026-85745
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
PT-2026-85779
IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...
PT-2026-85772
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements...