cve.bz

New CVEs this week, the last 7 days, newest first, page 89

Filter

The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday

  1. 6.7CVE-2026-95867EPSS 0.2%

    IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.

  2. 6.5CVE-2026-17427EPSS 0.2%

    IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper validation of input leng…

  3. 6.5CVE-2026-17426EPSS 0.2%

    IBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an unhandled exception.

  4. 6.5CVE-2026-16697EPSS 0.2%

    IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and  OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper restriction of excessiv…

  5. 6.5CVE-2026-16682EPSS 0.2%

    IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a …

  6. 8.1CVE-2026-118904EPSS 0.3%

    IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

  7. 8.8CVE-2026-9764EPSS 0.3%

    IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

  8. 8.1CVE-2026-97677EPSS 0.4%

    IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a craft…

  9. 7.5CVE-2026-93879EPSS 0.3%

    Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.

  10. 6.5CVE-2026-93005EPSS 0.2%

    IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.

  11. 6.5CVE-2026-8860EPSS 0.3%

    IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and se…

  12. 4.3CVE-2026-8642EPSS 0.2%

    IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulner…

  13. 3.5CVE-2026-8640EPSS 0.10%

    IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authentica…

  14. 8.8CVE-2026-8639EPSS 0.3%

    IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauth…

  15. 3.1CVE-2026-84237EPSS 0.4%

    IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

  16. 6.5CVE-2026-84229EPSS 0.2%

    IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests.

  17. 3.1CVE-2026-84228EPSS 0.3%

    IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.

  18. 5.6CVE-2026-84030EPSS 0.3%

    IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

  19. 6.7CVE-2026-82830EPSS 0.7%

    IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.

  20. 6.4CVE-2026-81542EPSS 0.3%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

  21. 4.9CVE-2026-81209EPSS 0.3%

    IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to obtain sensitive inform…

  22. 5.0CVE-2026-80435EPSS 0.2%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

  23. 4.3CVE-2026-78636EPSS 0.3%

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.

  24. 6.8CVE-2026-78537EPSS 0.08%

    IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive information due to the use of a weak cryptographic algorithm.

  25. 4.8CVE-2026-77153EPSS 0.2%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they sh…

  26. 4.3CVE-2026-75879EPSS 0.3%

    IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information.

  27. 9.8CVE-2026-6715EPSS 0.9%

    IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbit…

  28. 6.5CVE-2026-3684EPSS 0.3%

    IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.

  29. 4.3CVE-2026-2700EPSS 0.2%

    IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictio…

  30. 6.5CVE-2026-2477EPSS 0.3%

    IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypass…

  31. 4.3CVE-2026-19307EPSS 0.3%

    IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to acce…

  32. 8.1CVE-2026-19133EPSS 0.3%

    IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization.

  33. 7.1CVE-2026-18893EPSS 0.1%

    IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.

  34. 6.0CVE-2026-76052EPSS 0.1%

    IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthen…

  35. 6.5CVE-2026-18668EPSS 0.3%

    IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and  6.2.2.0 - 6.2.2.1_1 could allow a remote attacker to perform protocol downgrade attacks due to a security misconfiguration.

  36. 5.4CVE-2026-18546EPSS 0.2%

    IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests fr…

  37. 4.9CVE-2026-18525EPSS 0.3%

    IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port.

  38. 6.5CVE-2026-18484EPSS 0.5%

    IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions.

  39. 5.4CVE-2026-18196EPSS 0.2%

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.

  40. 4.2CVE-2026-18195EPSS 0.2%

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.

  41. 2.5CVE-2026-18194EPSS 0.1%

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.

  42. 7.5CVE-2026-18093EPSS 0.5%

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.

  43. 9.1CVE-2026-17466EPSS 0.4%

    IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

  44. 5.5CVE-2026-17437EPSS 0.2%

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.

  45. 6.5CVE-2026-16699EPSS 0.3%

    IBM Netezza Appliance 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 could allow a remote authenticated attacker to change the passwords of other users due to improper authorization.

  46. 6.5CVE-2026-16433EPSS 0.3%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.

  47. 6.5CVE-2026-16427EPSS 0.3%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.

  48. 4.4CVE-2026-16325EPSS 0.2%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.

  49. 9.8CVE-2026-15266EPSS 0.9%

    IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.

  50. 4.3CVE-2026-14963EPSS 0.1%

    IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to cross-site request forgery.