CVE-2026-17443

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection flaw...

CVE-2026-16689

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials...

EUVD-2026-71487

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials...

EUVD-2026-71472

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection flaw...

CVE-2026-17444

IBM App Connect Enterprise (13.0.1.0–13.0.8.1, 12.0.1.0–12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0–10.1.0.7) are affected by an XML external entity (XXE) injection in Adapter nodes , allowing a remote authenticated attacker with low privileges to obtain sensitive information. The vuln...

CVE-2026-17444 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

EUVD-2026-71463

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

EUVD-2026-71462

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

CVE-2026-17631

Langflow OSS 1.0.0–1.10.2 is vulnerable to a non-blind server-side request forgery (SSRF) (CWE-918) caused by missing URL validation in flow components for LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. An authenticated attacker can...

CVE-2026-78970

JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...

CVE-2026-77822

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...

CVE-2026-19305

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-19300

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...

CVE-2026-19299

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal...

CVE-2026-19301

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-18858 IBM i is Affected By Obtaining Sensitive Information Vulnerability in OpenSSH []

IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH...

CVE-2026-18887

IBM i 7.3 through 7.6 are affected by a sensitive information exposure vulnerability in the Portable Application Solutions Environment (PASE) , classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). An authenticated attacker with low privileges can access process info...

EUVD-2026-71597

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-18905 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

EUVD-2026-71315

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...