Threat database

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information.

IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input.

Langflow versions prior to 1.10.0 contain a remote code execution (RCE) vulnerability identified as CVE-2026-9198. An exploit exists that leverages an API endpoint to obtain a superuser token and then executes arbitrary code on the target system. The exploit has been tested on Ubuntu 22.04.

IBM Cloud Pak for Data System version 11.3.0.2 is affected by a vulnerability that allows denial of service due to improper limitation of resource allocation. This issue can cause the system to exhaust resources, leading to service disruption. The vulnerability has a medium severity rating with a CVSS score of 6.2. No official patch or remediation guidance has been provided yet by IBM.

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a critical vulnerability that allows an authenticated attacker to execute arbitrary operating system commands on the server. This occurs by saving a flow with a specially crafted type field and triggering a build of a wrapper flow referencing it. The vulnerability bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy, enabling privilege escalation from an authenticated flow user to OS-level command execution under the server process identity.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an authorization bypass vulnerability (CWE-639) that allows a remote authenticated attacker to execute and read any user's private flow. This occurs due to improper authorization checks related to user-controlled keys. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity impact.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a critical vulnerability (CVE-2026-19286) that allows remote attackers to execute arbitrary code via improper enforcement of security restrictions on the A2A public endpoint. This code injection flaw is due to CWE-94, improper control of code generation. The vulnerability has a CVSS score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an authorization bypass vulnerability due to a namespace collision between user identifiers. This flaw could allow a remote attacker to access sensitive information and inject unauthorized messages. The vulnerability is identified as CWE-639 and has a high severity with a CVSS score of 8.2.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a path traversal vulnerability that allows remote attackers to read arbitrary files. This vulnerability is identified as CWE-22 and has a high severity with a CVSS score of 7.5. No official patch or remediation has been confirmed at this time.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authentication vulnerability that could allow a remote attacker to execute arbitrary flows and access sensitive information without proper authorization. This vulnerability is identified as CWE-287 and has a high severity rating with a CVSS score of 8.2. No official patch or remediation guidance has been provided by the vendor as of the published date.