Veille CVE

Jeudi 8 octobre 2026

38 CVE

Critique 5 Élevée 23 Moyenne 10 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM i » ✕
  1. CVE-2026-14990 9.3 Critique

    IBM DataPower Gateway 10.6.0

    IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  2. CVE-2026-106434 4.3 Moyenne

    MongoDB libmongocrypt

    The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.

  3. CVE-2026-106433 8.8 Élevée

    MongoDB libmongocrypt

    Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

  4. CVE-2026-106429 6.5 Moyenne

    MongoDB libmongocrypt

    An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.

  5. CVE-2026-101329 6.5 Moyenne

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.

  6. CVE-2026-93674 9.8 Critique

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  7. CVE-2026-93443 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.

  8. CVE-2026-104334 9.8 Critique

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

  9. CVE-2026-93675 9.8 Critique

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.

  10. CVE-2026-93449 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

  11. CVE-2026-93447 7.5 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.

  12. CVE-2026-93445 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

  13. CVE-2026-88962 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

  14. CVE-2026-103360 6.5 Moyenne

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

  15. CVE-2026-101331 6.5 Moyenne

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

  16. CVE-2026-93677 6.5 Moyenne

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.

  17. CVE-2026-18156 6.5 Moyenne

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization.

  18. CVE-2026-18154 7.5 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.

  19. CVE-2026-18153 7.1 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors.

  20. CVE-2026-18152 7.5 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures.

  21. CVE-2026-17635 9.1 Critique

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.

  22. CVE-2026-17636 8.8 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.

  23. CVE-2026-17637 8.8 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.

  24. CVE-2026-17643 7.1 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.

  25. CVE-2026-17644 7.1 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.

  26. CVE-2026-17645 8.8 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.

  27. CVE-2026-97678 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.

  28. CVE-2026-97674 8.1 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.

  29. CVE-2026-97655 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.

  30. CVE-2026-17646 6.5 Moyenne

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references.

  31. CVE-2026-17647 8.8 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.

  32. CVE-2026-18066 7.1 Élevée

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift · Ibm financial transaction manager

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.

  33. CVE-2026-97680 8.3 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.

  34. CVE-2026-97679 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.

  35. CVE-2026-97676 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.

  36. CVE-2026-97673 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.

  37. CVE-2026-93679 4.3 Moyenne

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.

  38. CVE-2026-97671 6.5 Moyenne

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.