CVE Program partner

ibm

IBM Corporation

API
CVEs, 365 days1,5289,029 all time, 1,013 rejected
Quality98%median 99%
CVSS by the CNA98%share of records
CWE98%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA1%lower is better
OrganisationIBM Corporation
RoleCNA
TypeVendor, Open Source
Reports tomitre
ScopeAll IBM branded products (IBM will confirm support status and notify researcher).
Advisorieshttps://www.ibm.com/support/pages/bulletin/

Latest CVEs · RSS

  • CVE-2026-17068 2026-10-16 · CVSS 5.4
    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
  • CVE-2026-17073 2026-10-16 · CVSS 5.4
    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
  • CVE-2026-17275 2026-10-16 · CVSS 3.7
    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attack
  • CVE-2026-17488 2026-10-16 · CVSS 4.3
    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
  • CVE-2026-17491 2026-10-16 · CVSS 5.4
    IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory c
  • CVE-2026-102917 2026-10-16 · CVSS 7.8
    IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform opera
  • CVE-2026-107674 2026-10-16 · CVSS 5.1
    IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create se
  • CVE-2026-109838 2026-10-16 · CVSS 5.1
    IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
  • CVE-2026-109839 2026-10-16 · CVSS 3.1
    IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic a
  • CVE-2026-93905 2026-10-13 · CVSS 8.2
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch jo
  • CVE-2026-93909 2026-10-13 · CVSS 9.1
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enable
  • CVE-2026-93895 2026-10-13 · CVSS 9.1
    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gR
  • CVE-2026-95695 2026-10-13 · CVSS 7.4
    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorizat
  • CVE-2026-95696 2026-10-13 · CVSS 6.5
    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
  • CVE-2026-101294 2026-10-13 · CVSS 8.7
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass
  • CVE-2026-105442 2026-10-13 · CVSS 7.5
    IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to
  • CVE-2026-105443 2026-10-13 · CVSS 8.2
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
  • CVE-2026-11713 2026-10-13 · CVSS 5.4
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enab
  • CVE-2026-14532 2026-10-13 · CVSS 4.3
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught ex
  • CVE-2026-14909 2026-10-13 · CVSS 6.5
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacke
  • CVE-2026-77816 2026-10-13 · CVSS 6.5
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this
  • CVE-2026-79715 2026-10-13 · CVSS 5.5
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a
  • CVE-2026-93907 2026-10-13 · CVSS 8.1
    IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handl
  • CVE-2026-95680 2026-10-13 · CVSS 8.0
    IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the c
  • CVE-2026-103499 2026-10-13 · CVSS 7.5
    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthentic

All CVE Program partners