CVE-2024-49790Medium· 5.4▾ SunlitIBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentia…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
watson_assistant_for_ibm_cloud_pak_for_data >= 4.0.0, < 5.2.0Upgrade past the affected range:
watson_assistant_for_ibm_cloud_pak_for_data 5.2.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94402Medium· 6.1IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
CVE-2023-38375Medium· 6.1IBM Cloud Pak System Cross-Site Scripting
CVE-2026-3295High· 7.4IBM Cloud Pak System Cross-Site Scripting
CVE-2026-4413Medium· 6.1IBM Concert Software Cross-Site Scripting
CVE-2026-53711Medium· 5.1MCP Context Forge provides an MCP Admin UI for managing gateway resources
CVE-2026-93886High· 8.3IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.