Threat database

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.

IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of user supplied input.

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.

CVE-2026-75878 is a critical vulnerability in IBM Sterling File Gateway version 6.2.0.0 that allows remote attackers to bypass authentication by exploiting improper validation of an SSO header. This flaw enables attackers to obtain a fully authenticated session without valid credentials.

IBM Platform RTM, part of spectrum-lsf, is affected by a SQL injection vulnerability (CWE-89) that allows remote attackers to execute specially crafted SQL commands. This could enable unauthorized viewing, addition, modification, or deletion of data in the backend database. The vulnerability has a high severity with a CVSS score of 8.6. No specific affected versions or patch information is provided.

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

CVE-2026-11726 is a high-severity vulnerability in IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40. It involves an out-of-bounds read due to improper validation of message header offset values. An authenticated attacker could exploit this flaw to obtain sensitive information or cause a denial of service.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

IBM WebSphere Application Server versions 8.5 and 9.0 contain a vulnerability where the FileTransfer servlet may allow a remote attacker to obtain sensitive file system information. This issue is related to trusting HTTP permission methods on the server side (CWE-650). The vulnerability has a medium severity with a CVSS score of 4.3.

CVE-2026-11381 is a heap-based buffer overflow vulnerability in IBM MQ for HPE NonStop. It affects versions from 8.1.0 up to and including 8.1.0.40. The flaw arises from improper validation of message distribution list structures, which could allow an authenticated attacker to cause denial of service or potentially execute arbitrary code. The vulnerability has a high severity with a CVSS score of 8.8.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.

CVE-2026-10858 is a critical heap-based buffer overflow vulnerability in IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40. It allows an authenticated attacker to cause denial of service or potentially execute arbitrary code by exploiting a heap buffer underflow when processing multi-segment messages.

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.

CVE-2026-10841 is a medium severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, Liberty 17.0.0.3 through 26.0.0.5, and version 10.1. It involves inconsistent interpretation of HTTP requests, known as HTTP request/response smuggling (CWE-444). This flaw could allow an attacker to manipulate HTTP request processing, potentially impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 4.8, indicating a moderate risk. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain a heap-based buffer overflow vulnerability caused by an integer overflow in MQINQ request validation. This flaw could allow an authenticated attacker to cause denial of service or potentially escalate privileges.