CVE-2026-16725Medium· 6.5▾ SunlitIBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path traversal.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path traversal.
watson_speech_services_cartridge >= 4.0.0 <= 5.4.0Product(s)Version(s)Remediation/Fix/InstructionsIBM Watson Speech Services Cartridge5.4.0 Patch 8 The fix in 5.4.0 Patch 8 applies to all versions listed (4.0.0-5.4.0). The newest version of 5.4.0 with the included Patch 8 can be downloaded and installed from: https://www.ibm.com/docs/en/cloud-paks/cp-data/5.4.x
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19319Medium· 5.3IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read in Onnx
CVE-2026-17493High· 7.5IBM Watson Speech Services Cartridge is vulnerable to a D.O.S. in Unpacker.
CVE-2026-82418Critical· 9.8IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL
CVE-2026-104309Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
CVE-2026-110190Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
CVE-2026-110244High· 8.8Langflow OSS is affected by multiple vulnerabilities