Threat database

CVE-2026-86087 is a medium severity vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. It allows an authenticated user to send a specially crafted request that could write arbitrary files on the system due to improper limitation of a pathname to a restricted directory (path traversal). The vulnerability does not affect confidentiality or availability but impacts integrity. No patch information is provided in the input data.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

CVE-2026-87958 is a high-severity vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. It involves improper privilege management (CWE-269) that allows a privileged user to disable a specific functionality on the Db2 server, resulting in a denial of service condition.

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an authorization bypass vulnerability in the File/Read File component. An authenticated attacker with low privileges can exploit this flaw by supplying crafted file paths to access files belonging to other users. This occurs because the application does not properly verify ownership of storage paths when executing flows via the /api/v1/run/advanced/{flow_id} endpoint. The vulnerability allows unauthorized disclosure of sensitive user data without impacting data integrity or availability.

CVE-2026-9327 is a vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0 where an authenticated user with a low-privilege administrative role can modify security configurations. This improper privilege management flaw could lead to denial of service but does not impact confidentiality or integrity.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service.

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3 contain an authorization bypass vulnerability. This flaw arises from improper mapping of untrusted URL query parameters, allowing attackers to bypass authorization controls. The vulnerability is identified as CWE-639, related to authorization bypass through user-controlled keys. It has a high severity with a CVSS score of 7.4.

IBM Verify Identity Access Advanced Access Control versions 10.0.0 and 11.0.0 contain a vulnerability classified as CWE-1336, involving improper neutralization of special elements used in a template engine. This flaw may allow an attacker to perform an information disclosure attack. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating it can be exploited remotely without privileges or user interaction, resulting in high confidentiality impact but no integrity or availability impact. No patch or remediation details are currently provided.

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVE-2026-16689 is a vulnerability in IBM App Connect Enterprise and IBM Integration Bus for z/OS where sensitive information, such as credentials, may be improperly logged. This affects versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and 10.1.0.0 through 10.1.0.7. The vulnerability allows a local attacker to obtain sensitive information from log files. The CVSS 3.1 base score is 6.2, indicating a medium severity. There is no indication of known exploits in the wild or available patches in the provided data.

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to cause a denial of service due to uncontrolled recursion.