IBM has 773 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 630 in the last 90 days against 43 in the 90 before. The busiest recent month was September 2026 with 364. The median CVSS is 7.1 (high), with 79 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (53) and CWE-78 (50). Most affected products: guardium_data_protection (77), datastage_on_cloud_pak_for_data (51), i (51).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 630 prev 43
Weakness classes
Products
- guardium_data_protection 77
- datastage_on_cloud_pak_for_data 51
- i 51
- financial_transaction_manager 46
- datapower_gateway 42
- Concert 36
Worst active — by depth score
CVE-2026-107328Critical· 9.9Langflow OSS is affected by multiple vulnerabilities67CVE-2026-85542High· 8.8IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality67CVE-2026-53709Critical· 9.8MCP Context Forge is an MCP gateway and administrative platform66CVE-2026-12944Critical· 9.6IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports65CVE-2025-13915Critical· 9.8IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.56
IBM vulnerabilities
CVEs affecting IBM, newest first. Open any entry for full detail, references, and exploit status.
773 CVEsRSS
CVE-2026-10572High· 8.8IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
CVE-2026-11829Medium· 6.5IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests.
CVE-2026-12350Medium· 6.5IBM MQ Deserialization of Untrusted Data
IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.
CVE-2026-15661Medium· 5.3IBM Concert Software Improper Output Neutralization for Logs
IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
CVE-2026-12727Medium· 4.3IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.
CVE-2026-6930Low· 3.7IBM Concert Software Risky Cryptographic Algorithm
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2026-6719High· 7.5IBM Concert Software Use of Insufficiently Random Values
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2026-4413Medium· 6.1IBM Concert Software Cross-Site Scripting
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to c…
CVE-2026-4405Medium· 4.0IBM Concert Software Use of Web Browser Cache Containing Sensitive Information
IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.
CVE-2026-3628Medium· 5.3IBM Concert Software Information Disclosure
IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.
CVE-2026-3303Low· 3.7IBM Concert Software Permissive Cross-domain Security Policy
IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
CVE-2026-1501Low· 3.7IBM Concert Software Improper Certificate Validation
IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.
CVE-2026-1510Medium· 4.7IBM Concert Software Improper Clearing of Heap Memory
IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.
CVE-2026-17488Medium· 4.3IBM i is Affected By An Improper Authentication Vulnerability in SST / DST
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CVE-2026-102917High· 7.8IBM i is Affected By An Improper Privilege Management Vulnerability
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.
CVE-2026-17491Medium· 5.4IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH
IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.
CVE-2026-17073Medium· 5.4IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
CVE-2026-17068Medium· 5.4IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
CVE-2026-17275Low· 3.7IBM i is Affected by an Improper Validation Vulnerability
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
CVE-2026-109839Low· 3.1IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.
CVE-2026-109838Medium· 5.1IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
CVE-2026-107674Medium· 5.1IBM i is Affected by a Denial of Service in Digital Certificate Manager
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service fro…
CVE-2026-95696Medium· 6.5IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95695High· 7.4IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-93909Critical· 9.1IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93905High· 8.2IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-93895Critical· 9.1IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-79715Medium· 5.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended di…
CVE-2026-77816Medium· 6.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
CVE-2026-14909Medium· 6.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.