Veille CVE

Vendredi 4 septembre 2026

20 CVE sur 64

Critique 6 Élevée 20 Moyenne 37 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM i » ✕
  1. CVE-2026-18489 7.4 Élevée

    IBM ContextForge MCP Gateway - Translate utility · Ibm contextforge

    IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.

  2. CVE-2026-18486 8.8 Élevée

    IBM ContextForge MCP Gateway · Ibm contextforge

    IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.

  3. CVE-2026-18341 8.8 Élevée

    IBM i

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow.

  4. CVE-2026-18175 7.5 Élevée

    IBM i

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

  5. CVE-2026-17627 7.1 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.

  6. CVE-2026-17499 7.8 Élevée

    IBM i

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  7. CVE-2026-17470 7.5 Élevée

    IBM i

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.

  8. CVE-2026-17255 7.5 Élevée

    IBM i

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of the prefix length in ICMPv6 Router Advertisements.

  9. CVE-2026-16826 7.8 Élevée

    IBM i

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  10. CVE-2026-13297 7.5 Élevée

    IBM Verify Identity Access · IBM Security Verify Access · IBM Verify Identity Access Container · IBM Security Verify Access Container

    IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.

  11. CVE-2026-78543 7.5 Élevée

    IBM App Connect Enterprise · IBM Integration Bus for z/OS · Ibm integration bus for z\/os

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.

  12. CVE-2026-19306 7.7 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.

  13. CVE-2026-19305 7.5 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

  14. CVE-2026-19304 7.7 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

  15. CVE-2026-19303 8.1 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

  16. CVE-2026-19300 7.5 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.

  17. CVE-2026-19298 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

  18. CVE-2026-19283 7.7 Élevée

    IBM Observability with Instana (Agent)

    IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.

  19. CVE-2026-18905 7.7 Élevée

    IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) · Ibm contextforge

    IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.

  20. CVE-2026-81832 7.7 Élevée

    IBM App Connect Enterprise · IBM Integration Bus for z/OS · Ibm integration bus for z\/os

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity (XXE) attack.