webmethods-integration-server

IBM webMethods Integration Server 11.1 is affected by an XML external entity (XXE) injection vulnerability, also known as Blind XPath Injection (CWE-91). This vulnerability allows a remote attacker with limited privileges to exploit XML data processing to disclose sensitive information or cause resource exhaustion. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation details are provided in the available data.

CVE-2026-2310 describes an XML external entity injection vulnerability in IBM webMethods Integration Server version 11.1. The flaw arises during XML data processing, enabling a remote attacker with low privileges to perform XXE attacks. Exploitation could lead to unauthorized disclosure of sensitive information or consumption of memory resources, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, reflecting high severity. No vendor advisory or patch information is currently available.

CVE Database V5

Detailed information about CVE-2026-2310: CWE-91 XML Injection (aka Blind XPath Injection) in IBM webMethods Integration Server affecting IBM webMethods Integra

CVE-2026-2310: CWE-91 XML Injection (aka Blind XPath Injection) in IBM webMethods Integration Server - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-2310: CWE-91 XML Injection (aka Blind XPath Injection) in IBM webMethods Integration Server

IBM Common Licensing versions 9.0, 9.0.0.1, 9.0.0.2, and ART 9.0 series contain a vulnerability where improper validation of the HTTP Host header allows a remote attacker to redirect users to arbitrary domains. This vulnerability is identified as CWE-1149 and has a high severity with a CVSS score of 9.1.

CVE-2026-19646 affects IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2. The vulnerability arises from improper validation of the HTTP Host header, which can be exploited by a remote attacker to redirect users to arbitrary domains. This flaw is categorized under CWE-1149, related to platform security issues in Java coding standards. The CVSS v3.1 score is 9.1, indicating critical impact with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

Detailed information about CVE-2026-19646: CWE-1149 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) in IBM Common Licen

CVE-2026-19646: CWE-1149 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) in IBM Common Licensing - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-19646: CWE-1149 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) in IBM Common Licensing

langflow_oss

CVE-2026-84889 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3. It allows a remote authenticated attacker to execute arbitrary code by exploiting improper limitation of pathnames to restricted directories. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a CWE-22 path traversal vulnerability that permits remote authenticated attackers to execute arbitrary code. This occurs due to improper restriction of pathnames, enabling attackers to access or manipulate files outside intended directories. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No patch or remediation information is provided in the source data.

Detailed information about CVE-2026-84889: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS affecting I

CVE-2026-84889: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-84889: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS

datastage-on-cloud-pak-for-data

CVE-2026-82107 is a critical improper authentication vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It allows a remote authenticated attacker to bypass security restrictions and obtain sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without affecting availability.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authentication vulnerability (CWE-287) that could allow a remote attacker with valid authentication privileges to bypass security controls and access sensitive information. This vulnerability is classified as critical with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). No public exploits are known, and no patch or remediation details are provided in the available data.

Detailed information about CVE-2026-82107: CWE-287 Improper Authentication in IBM DataStage on Cloud Pak for Data affecting IBM DataStage on Cloud Pak for Data.

CVE-2026-82107: CWE-287 Improper Authentication in IBM DataStage on Cloud Pak for Data - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-82107: CWE-287 Improper Authentication in IBM DataStage on Cloud Pak for Data

CVE-2026-82100 is a critical path traversal vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It allows a remote authenticated attacker to cause a denial of service by improperly limiting pathname access to restricted directories. The vulnerability does not impact confidentiality but can lead to integrity and availability issues.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a CWE-22 path traversal vulnerability that permits a remote authenticated attacker to cause denial of service. This occurs due to improper limitation of pathname access, allowing traversal outside intended directories. The CVSS v3.1 score is 9.6, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on integrity and availability.

Detailed information about CVE-2026-82100: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM DataStage on Cloud Pak f

CVE-2026-82100: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM DataStage on Cloud Pak for Data - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-82100: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM DataStage on Cloud Pak for Data

The CVE-2026-32902 entry was reserved on March 16, 2026, but subsequently rejected by the CVE assignment authority, VulnCheck. The rejection status means that after review, the reported issue was determined not to meet the criteria for a valid vulnerability or was a duplicate, erroneous, or otherwise invalid submission. No affected software versions or technical details have been published, and no patches or mitigations are available or required. The absence of a CVSS score and lack of known exploits further confirm that this is not an actionable security concern. This CVE record should be considered informational only and not indicative of a real threat.

Detailed information about CVE-2026-32902. Get real-time updates, technical details, and mitigation strategies.

CVE-2026-32902 has been rejected

Official rejection reason