Veille CVE

Vendredi 18 septembre 2026

90 CVE

Critique 16 Élevée 45 Moyenne 28 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM i » ✕
  1. CVE-2026-84241 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization.

  2. CVE-2026-84239 7.6 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.

  3. CVE-2026-84108 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation.

  4. CVE-2026-84106 8.9 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

  5. CVE-2026-84105 7.7 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.

  6. CVE-2026-84089 7.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.

  7. CVE-2026-84086 7.2 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

  8. CVE-2026-84085 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

  9. CVE-2026-84084 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery (CSRF) vulnerability.

  10. CVE-2026-84083 7.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute arbitrary commands as root, resulting in full compromise of the Collector appliance.

  11. CVE-2026-84082 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

  12. CVE-2026-84081 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.

  13. CVE-2026-84078 9.9 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-balancer operations, potentially resulting in unauthorized actions and impact to the integrity and availability of the affected system.

  14. CVE-2026-84077 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability.

  15. CVE-2026-84076 7.6 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.

  16. CVE-2026-84075 9.9 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet.

  17. CVE-2026-84074 8.9 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

  18. CVE-2026-84073 9.1 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

  19. CVE-2026-84071 7.2 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in arbitrary command execution with root-level privileges.

  20. CVE-2026-84070 8.9 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

  21. CVE-2026-84064 9.9 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

  22. CVE-2026-84036 7.4 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.

  23. CVE-2026-84034 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthorized access to the internal database and compromise of sensitive system information.

  24. CVE-2026-84031 9.0 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

  25. CVE-2026-82967 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface.

  26. CVE-2026-82896 7.6 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability.

  27. CVE-2026-82893 7.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.

  28. CVE-2026-82892 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  29. CVE-2026-82890 5.9 Moyenne

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page generation.

  30. CVE-2026-82887 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  31. CVE-2026-82885 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.

  32. CVE-2026-82832 9.6 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

  33. CVE-2026-82340 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.

  34. CVE-2026-81937 7.2 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelog_config file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root privileges and impact to the confidentiality, integrity, and availability of the affected system.

  35. CVE-2026-81933 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in unauthorized access to sensitive data and impact to the confidentiality, integrity, and availability of the affected system.

  36. CVE-2026-81669 7.2 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inject arbitrary shell commands through the alias input, resulting in command execution with root privileges.

  37. CVE-2026-81657 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

  38. CVE-2026-81656 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.

  39. CVE-2026-81626 8.6 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.

  40. CVE-2026-81623 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of user supplied input.

  41. CVE-2026-80442 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.

  42. CVE-2026-80441 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.

  43. CVE-2026-75878 9.1 Critique

    IBM Sterling File Gateway

    IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header.

  44. CVE-2026-18869 6.4 Moyenne

    IBM i

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.

  45. CVE-2026-17619 8.6 Élevée

    IBM spectrum-lsf : IBM Platform RTM

    IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

  46. CVE-2026-17262 5.4 Moyenne

    IBM i

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.

  47. CVE-2026-11727 8.1 Élevée

    IBM MQ for HPE NonStop

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

  48. CVE-2026-11726 8.1 Élevée

    IBM MQ for HPE NonStop

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values.

  49. CVE-2026-11725 8.8 Élevée

    IBM MQ

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

  50. CVE-2026-11722 4.8 Moyenne

    IBM CICS TX Advanced

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.

  51. CVE-2026-11716 7.5 Élevée

    IBM MQ for HPE NonStop

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

  52. CVE-2026-11711 6.5 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.

  53. CVE-2026-11710 6.5 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.

  54. CVE-2026-11549 6.5 Moyenne

    IBM CICS TX Advanced

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.

  55. CVE-2026-11548 4.8 Moyenne

    IBM CICS TX Advanced

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.

  56. CVE-2026-11545 3.7 Faible

    IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.

  57. CVE-2026-11540 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

  58. CVE-2026-11539 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.

  59. CVE-2026-11538 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.

  60. CVE-2026-1037 6.1 Moyenne

    IBM Common Licensing

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  61. CVE-2026-1031 6.1 Moyenne

    IBM Common Licensing

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  62. CVE-2026-1030 4.3 Moyenne

    IBM Common Licensing

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data.

  63. CVE-2026-1029 5.4 Moyenne

    IBM Common Licensing

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  64. CVE-2026-1025 6.1 Moyenne

    IBM Common Licensing

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  65. CVE-2026-11537 4.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

  66. CVE-2026-11381 8.8 Élevée

    IBM MQ for HPE NonStop

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.

  67. CVE-2026-11378 8.8 Élevée

    IBM MQ

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.

  68. CVE-2026-11375 8.8 Élevée

    IBM MQ

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.

  69. CVE-2026-10858 9.9 Critique

    IBM MQ for HPE NonStop

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages.

  70. CVE-2026-10853 8.8 Élevée

    IBM MQ

    IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.

  71. CVE-2026-10841 4.8 Moyenne

    IBM CICS TX Advanced

    IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.

  72. CVE-2026-10751 7.5 Élevée

    IBM MQ

    IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.

  73. CVE-2026-10747 10.0 Critique

    IBM MQ Appliance

    IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.

  74. CVE-2026-10744 7.5 Élevée

    IBM MQ for HPE NonStop

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer overflow in MQINQ request validation.

  75. CVE-2026-10575 8.8 Élevée

    IBM MQ

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers.

  76. CVE-2026-10030 7.1 Élevée

    IBM MQ

    IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.

  77. CVE-2026-10027 9.8 Critique

    IBM MQ

    IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.

  78. CVE-2025-36421 5.9 Moyenne

    IBM Controller

    IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

  79. CVE-2025-36178 5.4 Moyenne

    IBM Controller

    IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

  80. CVE-2025-36147 6.1 Moyenne

    IBM Financial Transaction Manager for SWIFT Services for Multiplatforms

    IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  81. CVE-2025-36076 4.3 Moyenne

    IBM Cognos Analytics

    IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.

  82. CVE-2025-36045 4.3 Moyenne

    IBM TS4300

    IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

  83. CVE-2025-33147 5.9 Moyenne

    IBM Cognos Analytics

    IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.

  84. CVE-2025-33141 6.5 Moyenne

    IBM QRadar

    IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

  85. CVE-2025-15399 10.0 Critique

    IBM Common Licensing

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

  86. CVE-2025-14754 8.8 Élevée

    IBM Cloud Pak for Data

    IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

  87. CVE-2025-14753 7.5 Élevée

    IBM Cloud Pak for Data

    IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

  88. CVE-2025-13882 5.3 Moyenne

    IBM Sterling Partner Engagement Manager Essentials Edition · IBM Sterling Partner Engagement Manager Standard Edition

    IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

  89. CVE-2025-1350 5.3 Moyenne

    IBM Controller

    IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

  90. CVE-2024-56344 5.9 Moyenne

    IBM Cognos Analytics

    IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.