IBM has 1,023 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 876 in the last 90 days against 45 in the 90 before. The busiest recent month was September 2026 with 364. The median CVSS is 7.4 (high), with 132 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-918 (83) and CWE-79 (60). Most affected products: API Connect (208), guardium_data_protection (77), i (52).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.4
- Publish → KEV
- —
- Last 90 days
- 876 prev 45
Weakness classes
Products
- API Connect 208
- guardium_data_protection 77
- i 52
- datastage_on_cloud_pak_for_data 51
- financial_transaction_manager 46
- datapower_gateway 42
Worst active — by depth score
CVE-2026-107329Critical· 9.9Langflow OSS is affected by multiple vulnerabilities67CVE-2026-107328Critical· 9.9Langflow OSS is affected by multiple vulnerabilities67CVE-2026-107327Critical· 9.9Langflow OSS is affected by multiple vulnerabilities67CVE-2026-85542High· 8.8IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality67CVE-2026-93680Critical· 9.8Langflow OSS is affected by multiple vulnerabilities66
IBM vulnerabilities
CVEs affecting IBM, newest first. Open any entry for full detail, references, and exploit status.
1023 CVEsRSS
CVE-2024-49790Medium· 5.4IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting
IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentia…
CVE-2025-0966High· 7.6IBM InfoSphere Information Server SQL injection
IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2024-27275High· 7.4PoCIBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement
IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administrator privilege can configure a physical file trigger to execute with the priv…