Threat database

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation. This vulnerability is identified as CWE-94 (Code Injection). It has a high severity with a CVSS score of 8.8. No official patch or remediation details are currently provided by the vendor.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system. This may enable network enumeration or assist in other attacks. The vulnerability has a medium severity rating with a CVSS score of 4.3. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-18527 is a critical session fixation vulnerability in IBM Administration Runtime Expert for i version 1R1M0. It allows an unauthenticated remote attacker to execute actions under another user's authenticated profile, resulting in elevated privileges on the IBM i system. The vulnerability arises from the ARE GUI component processing. No patch or official remediation has been confirmed yet.

CVE-2026-17203 is a high severity vulnerability in IBM Administration Runtime Expert for i version 1R1M0. It involves improper authentication enforcement that could allow a remote unauthenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

A format string vulnerability (CWE-134) exists in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, which could allow a local attacker to gain elevated privileges. The vulnerability has a high severity with a CVSS score of 7. It requires local access with high attack complexity and no user interaction. No official patch or remediation information is currently available.

IBM Concert versions 1.0.0 through 2.3.1 contain an improper certificate validation vulnerability that could allow a remote attacker to perform unauthorized actions via man-in-the-middle techniques. The vulnerability is identified as CWE-295 and has a medium severity with a CVSS score of 5.9. No official patch or remediation guidance is currently available from the vendor. No known exploits are reported in the wild.

IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 contain a vulnerability due to improper TLS certificate validation. This flaw could allow an attacker to intercept sensitive information via man-in-the-middle techniques. The vulnerability is identified as CWE-295 and has a medium severity with a CVSS score of 5.9.

IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 use a one-way hash without a salt, employing weaker than expected cryptographic algorithms. This weakness could allow an attacker to decrypt highly sensitive information. The vulnerability is identified as CWE-759. No official patch or remediation guidance is currently available from the vendor. The CVSS 3.1 base score is 5.9, indicating a medium severity level.

CVE-2026-19783 is an out-of-bounds write vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It allows a local attacker to cause kernel memory corruption by exploiting insufficient validation during directory reads of a crafted filesystem image. This can lead to a system crash or potentially privilege escalation.

CVE-2026-19449 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The flaw exists in the cmdnim component and allows an unprivileged local user to execute code with root privileges. This vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. No information about patches or vendor advisories is provided.

CVE-2026-19448 is a stack memory corruption vulnerability in the IPsec ESP decapsulation handler of IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. Exploiting this flaw can corrupt kernel stack state and cause a system crash, resulting in denial of service. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource) and has a CVSS v3.1 base score of 6.5 (medium severity). No public exploits or patches are currently documented.

CVE-2026-19446 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It allows a remote unauthenticated attacker to send a crafted UDP packet to a reachable RPC service, causing uncontrolled resource consumption that results in complete system unavailability and requires an LPAR restart.

CVE-2026-19442 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 involving a pointer validation flaw in the AIX Virtual SCSI (vSCSI) initiator driver. Exploitation could lead to denial of service, privilege escalation, or full kernel compromise of the client LPAR. The vulnerability has a CVSS 3.1 score of 8.2, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

CVE-2026-19437 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 involving an out-of-bounds write (buffer overflow) that could allow a remote attacker to execute arbitrary code without privileges or user interaction.

CVE-2026-18835 is a critical OS command injection vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements in OS commands. The vulnerability has a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-18840 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves an untrusted pointer dereference due to improper validation of attacker-controlled pointers, which could allow a local attacker with high privileges to execute arbitrary code. The vulnerability has a CVSS 3.1 score of 8.2, indicating significant impact on confidentiality, integrity, and availability. No vendor patch or remediation information is currently provided.

CVE-2026-18842 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves an out-of-bounds write that could allow a local attacker to gain elevated privileges on the affected systems.

CVE-2026-18832 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves a heap-based buffer overflow that could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges.

CVE-2026-18828 is a medium severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves a stack-based buffer overflow that could be triggered remotely, potentially causing a denial of service. The vulnerability does not require user interaction or privileges to exploit. No known exploits are reported in the wild, and no official patch information is provided.