CVE-2026-18156: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...

CVE-2026-82832: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84073: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84036: Improper Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

CVE-2026-84070: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-18151: Concurrent Execution using Shared Resource with Improper Synchronization

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process...

CVE-2026-16466: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection...

CVE-2026-16432: Improper Restriction of XML External Entity Reference

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

CVE-2026-16428: Improper Control of Generation of Code

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine...

CVE-2026-81268: Insufficient Session Expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation...

CVE-2026-79742: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

CVE-2026-80436: Improper Authorization

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization...

CVE-2026-82100: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

CVE-2026-12645: Missing Authorization

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12647: Missing Authorization

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-17274: Use of Insufficiently Random Values

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds...

CVE-2026-19304: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...

CVE-2026-17168: Out-of-bounds Write

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

CVE-2026-16825

IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 are affected by an out-of-bounds write (CVSS 4.2 MEDIUM) exploitable by a remote authenticated attacker to obtain sensitive information and cause denial of service. No exploitation or remediation details are provided; refer to IBM advisory https://www.ibm.co...

CVE-2026-15068 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...