IBM has 749 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 611 in the last 90 days against 38 in the 90 before. The busiest recent month was September 2026 with 364. The median CVSS is 7.2 (high), with 77 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (53) and CWE-78 (49). Most affected products: guardium_data_protection (77), datastage_on_cloud_pak_for_data (51), i (51).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 611 prev 38
Weakness classes
Products
- guardium_data_protection 77
- datastage_on_cloud_pak_for_data 51
- i 51
- financial_transaction_manager 46
- datapower_gateway 42
- Concert 36
Worst active — by depth score
CVE-2026-85542High· 8.8IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality67CVE-2026-53709Critical· 9.8MCP Context Forge is an MCP gateway and administrative platform66CVE-2026-12944Critical· 9.6IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports65CVE-2025-13915Critical· 9.8IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.56CVE-2026-81212Critical· 10.0DataStage on Cloud Pak for Data Improper Authorization55
IBM vulnerabilities
CVEs affecting IBM, newest first. Open any entry for full detail, references, and exploit status.
749 CVEsRSS
CVE-2026-94402Medium· 6.1IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write w…
CVE-2026-93888High· 7.8IBM Sterling Connect:Direct for Unix Buffer Overflow
IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.
CVE-2026-82891High· 8.1IBM Guardium Data Protection is affected by a security vulnerability
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
CVE-2026-93744Medium· 6.5IBM i Improper Authentication
IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to a…
CVE-2026-93442High· 8.2IBM QRadar SIEM Out-of-bounds Read
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
CVE-2026-93441High· 8.6IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service
IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-9825Low· 3.7IBM Cyber Fraud Reachable Assertion
IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
CVE-2026-87800Medium· 6.8IBM Cyber Fraud includes components with multiple known vulnerabilities
IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type.
CVE-2026-92559Critical· 9.8IBM App Connect Enterprise is vulnerable to a credential exposure
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
CVE-2026-81212Critical· 10.0DataStage on Cloud Pak for Data Improper Authorization
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller …
CVE-2026-76587High· 8.8IBM Planning Analytics Buffer Overflow
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.
CVE-2026-8355Medium· 5.4IBM ContextForge MCP Gateway is affected by server-side request forgery
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources…
CVE-2026-109126High· 8.8IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.
CVE-2026-107400High· 8.8Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.
CVE-2026-107366High· 8.3Langflow OSS Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hija…
CVE-2026-105453High· 8.4IBM Sterling Connect:Direct for Unix Improper Privilege Management
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.
CVE-2025-36252Medium· 6.3TS4500 Tape Library Insufficient Session Expiration
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.
CVE-2026-19178Medium· 6.8TS4500 Tape Library Race Condition
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.
CVE-2025-36069Medium· 5.5TS4500 Tape Library Insufficient Session Expiration
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
CVE-2025-36061Medium· 6.5TS4500 Tape Library Denial of Service
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume exces…
CVE-2026-3161Medium· 5.9IBM Cloud Pak System Risky Cryptographic Algorithm
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2023-38375Medium· 6.1IBM Cloud Pak System Cross-Site Scripting
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2026-4418Medium· 5.4IBM Cloud Pak System HTML Injection
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context o…
CVE-2026-3295High· 7.4IBM Cloud Pak System Cross-Site Scripting
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vul…
CVE-2026-12670Medium· 5.3IBM MQ Denial of Service
IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.
CVE-2026-12669Low· 3.1IBM MQ Out-of-bounds Read
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
CVE-2026-12665High· 8.1IBM MQ Buffer Overflow
IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.
CVE-2026-12660Low· 2.7IBM MQ Path Traversal
IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.
CVE-2026-12343Medium· 6.5IBM MQ Denial of Service
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations.
CVE-2026-12155Medium· 6.5IBM MQ Deserialization of Untrusted Data
IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.