EUVD-2026-78071

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

CVE-2026-13277 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

EUVD-2026-78068

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...

EUVD-2026-78067

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

EUVD-2026-78056

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...

CVE-2026-15955

IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.5 (Client editions on Linux and Unix ; Windows unaffected) are vulnerable to arbitrary file write via the IBM Data Server driver for JDBC and SQLJ . The root cause is improper validation of file paths (CWE-22 / Path Traversal), allowing a malicious D...

CVE-2026-15955 IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

EUVD-2026-78054

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-16186

IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 are affected by a reflected cross-site scripting (XSS) vulnerability. The flaw requires user interaction and is exploitable over the network without authentication, but impact is limited to low confidentiality and integrity ...

EUVD-2026-78053

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

CVE-2026-16188 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

EUVD-2026-77801

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability...

CVE-2026-16190

IBM WebSphere Application Server versions 9.0 and 8.5 are affected by an authorization bypass vulnerability classified as CWE-862 (Missing Authorization) . The CVSS 3.1 score is 3.1 (LOW) with vector AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating exploitation requires an adjacent network positio...

CVE-2026-16190 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability...

CVE-2026-16335

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to read, write, or delete arbitrary files. The CVSS v3.1 score is 8.1 (HIGH) , with low attack complexity, low privileges required, and no scope change; impact ...

EUVD-2026-77798

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability...

CVE-2026-16338 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

EUVD-2026-77797

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-16338

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an arbitrary file write vulnerability (CVE-2026-16338) caused by improper validation of file paths (CWE-73: External Control of File Name or Path). A remote authenticated attacker can exploit this to write files to arbitrary locations, wi...

CVE-2026-16435

IBM WebSphere Application Server versions 9.0 and 8.5 are affected by an authentication bypass vulnerability that occurs when the XD or Intelligent-Management features are in use. The root cause is classified as CWE-650 (Trusting HTTP Permission Methods on the Server Side) , meaning the server in...