Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423702 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-6715 | 1 Ibm | 1 Concert | 2026-11-08 | 9.8 Critical |
| IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service. | ||||
| CVE-2026-3684 | 1 Ibm | 1 Cloud Pak For Data System | 2026-11-08 | 6.5 Medium |
| IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments. | ||||
| CVE-2026-14377 | 1 Ibm | 1 Turbonomic Kubeturbo Agent | 2026-11-08 | 5.4 Medium |
| IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | ||||
| CVE-2026-2477 | 1 Ibm | 1 Watsonx Orchestrate Cartridge For Cloud Pak For Data | 2026-11-08 | 6.5 Medium |
| IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions. | ||||
| CVE-2026-19307 | 1 Ibm | 2 Sterling B2b Integrator, Sterling File Gateway | 2026-11-08 | 4.3 Medium |
| IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to access unauthorized pages due to improper authorization. | ||||
| CVE-2026-19133 | 1 Ibm | 1 Storage Ts4500 Library | 2026-11-08 | 8.1 High |
| IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization. | ||||
| CVE-2026-18893 | 1 Ibm | 1 Cockroachdb Postgresql For Ibm Vpc | 2026-11-08 | 7.1 High |
| IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function. | ||||
| CVE-2026-18546 | 1 Ibm | 1 Cockroachdb Postgresql For Ibm Vpc | 2026-11-08 | 5.4 Medium |
| IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | ||||
| CVE-2026-124493 | 1 Jihong88 | 1 Suneditor | 2026-11-08 | N/A |
| SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft. | ||||
| CVE-2026-18525 | 1 Ibm | 1 Secure Proxy | 2026-11-08 | 4.9 Medium |
| IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port. | ||||
| CVE-2026-17466 | 1 Ibm | 1 Optim | 2026-11-08 | 9.1 Critical |
| IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal. | ||||
| CVE-2026-15266 | 1 Ibm | 1 Concert | 2026-11-08 | 9.8 Critical |
| IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host. | ||||
| CVE-2026-14963 | 1 Ibm | 1 Cognos Command Center | 2026-11-08 | 4.3 Medium |
| IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to cross-site request forgery. | ||||
| CVE-2026-14437 | 1 Ibm | 1 Storage Scale | 2026-11-08 | 6.5 Medium |
| IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. | ||||
| CVE-2026-14469 | 1 Ibm | 1 Storage Scale | 2026-11-08 | 5.4 Medium |
| IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization. | ||||
| CVE-2026-14435 | 1 Ibm | 1 Turbonomic Kubeturbo Agent | 2026-11-08 | 5.9 Medium |
| IBM Turbonomic kubeturbo agent 8.16.0 through 8.20.3 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques. | ||||
| CVE-2026-14375 | 1 Ibm | 1 Storage Scale | 2026-11-08 | 5.9 Medium |
| IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques. | ||||
| CVE-2026-12737 | 1 Ibm | 2 Sterling B2b Integrator, Sterling File Gateway | 2026-11-08 | 4.4 Medium |
| IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.1_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.1_1 stores potentially sensitive information in log files that could be read by a local privileged user. | ||||
| CVE-2026-12735 | 1 Ibm | 1 Controller Disclosure Management | 2026-11-08 | 4.3 Medium |
| IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage. | ||||
| CVE-2026-120113 | 1 Ibm | 1 Aspera Connect | 2026-11-08 | 6.4 Medium |
| IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration. | ||||