Veille CVE

Octobre 2026

282 CVE

Critique 43 Élevée 125 Moyenne 104 Faible 9 Non évaluée 1 Exploitées (KEV) Tri : plus récentes « IBM i » ✕
  1. CVE-2026-92824 6.2 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Hardened Images

    A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

  2. CVE-2026-92823 6.2 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Hardened Images

    A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

  3. CVE-2026-92822 6.2 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Hardened Images

    A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

  4. CVE-2026-9825 3.7 Faible

    IBM CyberFraud

    IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.

  5. CVE-2026-94402 6.1 Moyenne

    IBM @carbon/charts · IBM @carbon/charts-react · IBM @carbon/charts-angular · IBM @carbon/charts-vue

    IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

  6. CVE-2026-93888 7.8 Élevée

    IBM Sterling Connect Direct for Unix

    IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.

  7. CVE-2026-93744 6.5 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.

  8. CVE-2026-93442 8.2 Élevée

    IBM QRadar

    IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.

  9. CVE-2026-93441 8.6 Élevée

    IBM QRadar Security Information and Event Management

    IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

  10. CVE-2026-92559 9.8 Critique

    IBM App Connect Enterprise

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.

  11. CVE-2026-87800 6.8 Moyenne

    IBM Cyber Fraud

    IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type.

  12. CVE-2026-82891 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.

  13. CVE-2026-81212 10.0 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.

  14. CVE-2026-76587 8.8 Élevée

    IBM Planning Analytics

    IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.

  15. CVE-2026-8355 5.4 Moyenne

    IBM ContextForge MCP Gateway

    IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters.

  16. CVE-2026-109126 8.8 Élevée

    IBM Verify Identity Access · IBM Security Verify Access

    IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

  17. CVE-2026-107400 8.8 Élevée

    IBM TRIRIGA Application Platform

    IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

  18. CVE-2026-107366 8.3 Élevée

    IBM Langflow OSS

    IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

  19. CVE-2026-105453 8.4 Élevée

    IBM Sterling Connect Direct for Unix

    IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

  20. CVE-2026-19178 6.8 Moyenne

    IBM Storage TS4500 Library

    IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.

  21. CVE-2025-36252 6.3 Moyenne

    IBM Storage TS4500 Library

    IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.

  22. CVE-2025-36069 5.5 Moyenne

    IBM Storage TS4500 Library

    IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

  23. CVE-2025-36061 6.5 Moyenne

    IBM Storage TS4500 Library

    IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources.

  24. CVE-2026-6719 7.5 Élevée

    IBM Concert

    IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

  25. CVE-2026-4418 5.4 Moyenne

    IBM Cloud Pak System

    IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

  26. CVE-2026-4413 6.1 Moyenne

    IBM Concert

    IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  27. CVE-2026-4405 4.0 Moyenne

    IBM Concert

    IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.

  28. CVE-2026-3628 5.3 Moyenne

    IBM Concert

    IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.

  29. CVE-2026-3303 3.7 Faible

    IBM Concert

    IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.

  30. CVE-2026-3295 7.4 Élevée

    IBM Cloud Pak System

    IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).

  31. CVE-2026-3161 5.9 Moyenne

    IBM Cloud Pak System

    IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

  32. CVE-2026-1510 4.7 Moyenne

    IBM Concert

    IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.

  33. CVE-2026-1501 3.7 Faible

    IBM Concert

    IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.

  34. CVE-2023-38375 6.1 Moyenne

    IBM Cloud Pak System

    IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  35. CVE-2026-6930 3.7 Faible

    IBM Concert

    IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

  36. CVE-2026-15661 5.3 Moyenne

    IBM Concert

    IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

  37. CVE-2026-14511 6.5 Moyenne

    IBM MQ

    IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications.

  38. CVE-2026-12727 4.3 Moyenne

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.

  39. CVE-2026-12670 5.3 Moyenne

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.

  40. CVE-2026-12669 3.1 Faible

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.

  41. CVE-2026-12665 8.1 Élevée

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.

  42. CVE-2026-12660 2.7 Faible

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.

  43. CVE-2026-12350 6.5 Moyenne

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.

  44. CVE-2026-12343 6.5 Moyenne

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations.

  45. CVE-2026-12155 6.5 Moyenne

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.

  46. CVE-2026-12148 7.5 Élevée

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.

  47. CVE-2026-11831 5.4 Moyenne

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.

  48. CVE-2026-11829 6.5 Moyenne

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests.

  49. CVE-2026-11828 5.9 Moyenne

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values.

  50. CVE-2026-10743 8.8 Élevée

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.

  51. CVE-2026-10574 8.8 Élevée

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.

  52. CVE-2026-10572 8.8 Élevée

    IBM MQ Operator · IBM MQ Advanced container images

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.

  53. CVE-2026-112008 6.1 Moyenne

    libmng

    libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.

  54. CVE-2026-17491 5.4 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.

  55. CVE-2026-17488 4.3 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

  56. CVE-2026-17275 3.7 Faible

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.

  57. CVE-2026-17073 5.4 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.

  58. CVE-2026-17068 5.4 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.

  59. CVE-2026-107674 5.1 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections.

  60. CVE-2026-102917 7.8 Élevée

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.

  61. CVE-2026-109839 3.1 Faible

    IBM Db2 Genius Hub

    IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.

  62. CVE-2026-109838 5.1 Moyenne

    IBM Db2 Genius Hub

    IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.

  63. CVE-2026-111271 5.5 Moyenne

    Konstanty Bialkowski libmodplug

    libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.

  64. CVE-2026-111270 6.1 Moyenne

    Konstanty Bialkowski libmodplug

    libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

  65. CVE-2026-111166 5.5 Moyenne

    sezero libmikmod

    libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file.

  66. CVE-2026-111165 5.5 Moyenne

    sezero libmikmod

    libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.

  67. CVE-2026-111158 5.5 Moyenne

    EarthScope libmseed

    EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially crashing the process.

  68. CVE-2026-53614 7.0 Élevée

    util-linux

    util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

  69. CVE-2026-110602 6.3 Moyenne

    kyz libmspack

    libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

  70. CVE-2026-98396 – Non évaluée

    Linux

    In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back. Looks like GENERIC_ENTRY might be treating arch_exit_to_user_mode_prepare() as the last architecture step before returning to userspace. commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") therefore called kuap_user_restore() from that hook. But on PowerPC that is too early. After irqentry_exit() / syscall_exit_to_user_mode() we still run platform specific exit routines. e.g. code snippets showing both exception handling and system call handling as the callers of function arch_exit_to_user_mode_prepare() which does kuap_user_restore(). The below path shows that calling kuap_user_restore() is too early when called from arch_exit_to_user_mode_prepare(). Exception handling in exceptions-64s.S ======================================= bl CFUNC(do_page_fault) ..DEFINE_INTERRUPT_HANDLER_ASYNC(do_page_fault) arch_interrupt_async_enter_prepare(regs); state = irqentry_enter(regs); instrumentation_begin(); irq_enter_rcu(); handler(regs); nap_adjust_return(regs); irq_exit_rcu(); instrumentation_end(); arch_interrupt_async_exit_prepare(regs); irqentry_exit(regs, state); <<< too early irqentry_exit_to_user_mode() __exit_to_user_mode_prepare(regs, EXIT_TO_USER_MODE_WORK_IRQ); arch_exit_to_user_mode_prepare(regs, ti_work); <<< too early b interrupt_return_srr .. bl CFUNC(interrupt_exit_user_prepare) <<< already calls kuap_user_restore prep_irq_for_enabled_exit() retry can run kernel code with IRQs on. So only when that routine is fully finished is when the user KUAP should be fully restored which interrupt_exit_user_prepare() already takes care of before returning. Similarly for system call handling in interrupt_64.S ====================================================== bl CFUNC(system_call_exception) .Lsyscall_exit: addi r4,r1,STACK_INT_FRAME_REGS li r5,0 /* !scv */ bl CFUNC(syscall_exit_prepare) .. kuap_assert_locked(); syscall_exit_to_user_mode(regs); <<< too early syscall_exit_to_user_mode_prepare(regs); <<< too early kuap_user_restore(regs); <<< already calls syscall_exit_prepare(), which can enable IRQs, replay a pending interrupt, and only then rfi. Those functions already restore KUAP immediately before rfi. Note that if we restore the user AMR too early like in the current code as shown from the code snippets above, then we get the following warning when CONFIG_PPC_KUAP_DEBUG is enabled: WARNING: arch/powerpc/include/asm/book3s/64/kup.h:293 at interrupt_exit_user_prepare+0x1a0/0x1c0 Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) TRAP: 0700 LR: c00000000000d8d4 CTR: c0000000021fe500 MSR: <SF,EE,ME,IR,DR,RI,LE> CR: 44000804 XER: 20040000 interrupt_exit_user_prepare+0x1a0/0x1c0 interrupt_return_srr_user+0x8/0x12c

  71. CVE-2026-95696 6.5 Moyenne

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.

  72. CVE-2026-95695 7.4 Élevée

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

  73. CVE-2026-93909 9.1 Critique

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

  74. CVE-2026-93905 8.2 Élevée

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

  75. CVE-2026-93895 9.1 Critique

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

  76. CVE-2026-79715 5.5 Moyenne

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.

  77. CVE-2026-77816 6.5 Moyenne

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.

  78. CVE-2026-14909 6.5 Moyenne

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.

  79. CVE-2026-14532 4.3 Moyenne

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.

  80. CVE-2026-11713 5.4 Moyenne

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.

  81. CVE-2026-105443 8.2 Élevée

    IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.

  82. CVE-2026-105442 7.5 Élevée

    IBM WebSphere Application Server · IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.

  83. CVE-2026-101294 8.7 Élevée

    IBM WebSphere Application Server - Liberty · IBM WebSphere Application Server

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.

  84. CVE-2026-110247 8.4 Élevée

    Mozilla Thunderbird

    Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.

  85. CVE-2026-65198 8.6 Élevée

    Huawei openUBMC

    Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

  86. CVE-2026-53711 5.1 Moyenne

    IBM mcp-context-forge

    MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.

  87. CVE-2026-53709 9.8 Critique

    IBM mcp-context-forge

    MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.

  88. CVE-2026-95680 8.0 Élevée

    IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

  89. CVE-2026-93907 8.1 Élevée

    IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

  90. CVE-2026-103499 7.5 Élevée

    IBM WebSphere Application Server - Liberty · IBM WebSphere Application Server

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.

  91. CVE-2026-96119 9.9 Critique

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

  92. CVE-2026-93886 5.4 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

  93. CVE-2026-81858 8.1 Élevée

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

  94. CVE-2026-18343 4.4 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

  95. CVE-2026-18318 5.3 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

  96. CVE-2026-17487 5.3 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

  97. CVE-2026-17484 5.5 Moyenne

    IBM i

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

  98. CVE-2026-93892 8.1 Élevée

    IBM TRIRIGA Application Platform

    IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.

  99. CVE-2026-93891 7.6 Élevée

    IBM TRIRIGA Application Platform

    IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

  100. CVE-2026-92832 5.1 Moyenne

    IBM Aspera Enterprise WebApps

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.

  101. CVE-2026-85457 8.1 Élevée

    IBM Planning Analytics

    IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

  102. CVE-2026-84418 7.4 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.

  103. CVE-2026-82110 9.9 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

  104. CVE-2026-82108 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  105. CVE-2026-82103 6.5 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.

  106. CVE-2026-82101 9.6 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

  107. CVE-2026-82096 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  108. CVE-2026-75782 7.8 Élevée

    IBM Aspera Enterprise WebApps

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.

  109. CVE-2026-75621 6.2 Moyenne

    IBM Aspera Enterprise WebApps

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.

  110. CVE-2026-75095 7.5 Élevée

    IBM Aspera Enterprise WebApps

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

  111. CVE-2026-75076 4.3 Moyenne

    IBM Aspera Enterprise WebApps

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.

  112. CVE-2026-75063 5.4 Moyenne

    IBM Planning Analytics

    IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.

  113. CVE-2026-75061 7.5 Élevée

    IBM Planning Analytics

    IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

  114. CVE-2026-19627 8.2 Élevée

    IBM Planning Analytics

    IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

  115. CVE-2026-19622 9.8 Critique

    IBM Planning Analytics

    IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

  116. CVE-2026-19620 8.8 Élevée

    IBM Planning Analytics

    IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.

  117. CVE-2026-18541 5.4 Moyenne

    IBM Planning Analytics

    IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  118. CVE-2026-17475 7.1 Élevée

    IBM Planning Analytics

    IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.

  119. CVE-2026-102627 8.8 Élevée

    IBM TRIRIGA Application Platform

    IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.

  120. CVE-2026-92876 7.5 Élevée

    IBM Maximo Application Suite - IoT Component

    IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

  121. CVE-2026-90921 7.5 Élevée

    IBM Maximo AI Service

    IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.

  122. CVE-2026-90920 9.8 Critique

    IBM Maximo AI Service

    IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

  123. CVE-2026-90912 7.5 Élevée

    IBM Maximo AI Service

    IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

  124. CVE-2026-90911 7.5 Élevée

    IBM Maximo AI Service

    IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

  125. CVE-2026-49484 5.1 Moyenne

    codefori vscode-ibmi

    Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.

  126. CVE-2026-49483 8.9 Élevée

    codefori vscode-ibmi

    Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

  127. CVE-2026-96266 8.2 Élevée

    IBM PowerVM Hypervisor

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

  128. CVE-2026-96265 8.2 Élevée

    IBM PowerVM Hypervisor

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

  129. CVE-2026-96264 8.2 Élevée

    IBM PowerVM Hypervisor

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.

  130. CVE-2026-96263 8.2 Élevée

    IBM PowerVM Hypervisor

    IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.

  131. CVE-2026-96262 8.2 Élevée

    IBM PowerVM Hypervisor

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.

  132. CVE-2026-96261 7.3 Élevée

    IBM PowerVM Hypervisor

    IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.

  133. CVE-2026-78673 7.5 Élevée

    IBM Maximo AI Service

    IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.

  134. CVE-2026-75881 7.5 Élevée

    IBM Maximo Application Suite - IoT Component

    IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.

  135. CVE-2026-18537 8.7 Élevée

    IBM Maximo Application Suite - Location Service for Esri Component

    IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.

  136. CVE-2026-18533 6.5 Moyenne

    IBM Maximo Application Suite - Location Service for Esri Component

    IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template.

  137. CVE-2026-18529 8.7 Élevée

    IBM Maximo Application Suite - Location Service for Esri Component

    IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.

  138. CVE-2026-18517 7.7 Élevée

    IBM Maximo Application Suite - Location Service for Esri Component

    IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.

  139. CVE-2026-18513 7.2 Élevée

    IBM Maximo Application Suite - Location Service for Esri Component

    IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

  140. CVE-2026-16678 4.5 Moyenne

    IBM Virtualization Management Interface

    IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources due to improper resource management.

  141. CVE-2026-105052 7.5 Élevée

    IBM Maximo Application Suite

    IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

  142. CVE-2026-96012 9.9 Critique

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.

  143. CVE-2026-104364 3.3 Faible

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.

  144. CVE-2026-104332 5.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

  145. CVE-2025-27902 6.1 Moyenne

    IBM DB2 Recovery Expert for Linux, UNIX and Windows

    IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser

  146. CVE-2025-27897 6.1 Moyenne

    IBM DB2 Recovery Expert for Linux, UNIX and Windows

    IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  147. CVE-2025-27896 6.1 Moyenne

    IBM DB2 Recovery Expert for Linux, UNIX and Windows

    IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  148. CVE-2025-27895 6.1 Moyenne

    IBM DB2 Recovery Expert for Linux, UNIX and Windows

    IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  149. CVE-2026-78404 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

  150. CVE-2026-18166 7.7 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.