ibm has 749 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 611 in the last 90 days against 38 in the 90 before. The busiest recent month was September 2026 with 364. The median CVSS is 7.2 (high), with 77 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (53) and CWE-78 (49). Most affected products: guardium_data_protection (77), datastage_on_cloud_pak_for_data (51), i (51).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 611 prev 38
Weakness classes
Products
- guardium_data_protection 77
- datastage_on_cloud_pak_for_data 51
- i 51
- financial_transaction_manager 46
- datapower_gateway 42
- Concert 36
Worst active — by depth score
CVE-2026-85542High· 8.8IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality67CVE-2026-53709Critical· 9.8MCP Context Forge is an MCP gateway and administrative platform66CVE-2026-12944Critical· 9.6IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports65CVE-2025-13915Critical· 9.8IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.56CVE-2026-81212Critical· 10.0DataStage on Cloud Pak for Data Improper Authorization55
ibm vulnerabilities
CVEs affecting ibm, newest first. Open any entry for full detail, references, and exploit status.
749 CVEsRSS
CVE-2026-12148High· 7.5IBM MQ Deserialization of Untrusted Data
IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.
CVE-2026-11831Medium· 5.4IBM MQ Heap-based Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.
CVE-2026-11828Medium· 5.9IBM MQ Buffer Overflow
IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of …
CVE-2026-10743High· 8.8IBM MQ Race Condition
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
CVE-2026-10574High· 8.8IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
CVE-2026-14511Medium· 6.5IBM MQ Denial of Service
IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications.
CVE-2026-10572High· 8.8IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
CVE-2026-11829Medium· 6.5IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests.
CVE-2026-12350Medium· 6.5IBM MQ Deserialization of Untrusted Data
IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.
CVE-2026-15661Medium· 5.3IBM Concert Software Improper Output Neutralization for Logs
IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
CVE-2026-12727Medium· 4.3IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.
CVE-2026-6930Low· 3.7IBM Concert Software Risky Cryptographic Algorithm
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2026-6719High· 7.5IBM Concert Software Use of Insufficiently Random Values
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2026-4413Medium· 6.1IBM Concert Software Cross-Site Scripting
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to c…
CVE-2026-4405Medium· 4.0IBM Concert Software Use of Web Browser Cache Containing Sensitive Information
IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.
CVE-2026-3628Medium· 5.3IBM Concert Software Information Disclosure
IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.
CVE-2026-3303Low· 3.7IBM Concert Software Permissive Cross-domain Security Policy
IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
CVE-2026-1501Low· 3.7IBM Concert Software Improper Certificate Validation
IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.
CVE-2026-1510Medium· 4.7IBM Concert Software Improper Clearing of Heap Memory
IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.
CVE-2026-17488Medium· 4.3IBM i is Affected By An Improper Authentication Vulnerability in SST / DST
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CVE-2026-102917High· 7.8IBM i is Affected By An Improper Privilege Management Vulnerability
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.
CVE-2026-17491Medium· 5.4IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH
IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.
CVE-2026-17073Medium· 5.4IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
CVE-2026-17068Medium· 5.4IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
CVE-2026-17275Low· 3.7IBM i is Affected by an Improper Validation Vulnerability
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
CVE-2026-109839Low· 3.1IBM Db2 Genius Hub Missing Cryptographic Step
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.
CVE-2026-109838Medium· 5.1IBM Db2 Genius Hub Improper verification of cryptographic signature
IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
CVE-2026-107674Medium· 5.1IBM i is Affected by a Denial of Service in Digital Certificate Manager
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service fro…
CVE-2026-95696Medium· 6.5IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95695High· 7.4IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.