Threat database

CVE-2026-19483 is a vulnerability in IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.0.0 through 6.0.1.0 where sensitive information, including the admin password, may be logged in the GUI log files. This occurs in the Storage Scale Management GUI during system deployment and upgrade processes. The vulnerability involves insertion of sensitive information into log files, potentially exposing secrets related to exceptions and administrative credentials.

IBM Langflow OSS versions 1.0.0 through 1.9.6 contain a vulnerability due to improper restriction of excessive authentication attempts. This flaw could allow a remote attacker to gain unauthorized access to user accounts without any user interaction. The vulnerability is classified as critical with a CVSS score of 9.1, indicating high impact on confidentiality and integrity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-18715 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper restriction of XML external entity references (CWE-611), which could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability, only confidentiality. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

IBM i versions 7.3 through 7.6 contain an integer overflow vulnerability in the NetServer component. An authenticated attacker could exploit this flaw to cause a server thread exception, resulting in a temporary denial of service. The vulnerability arises during bounds checking in request processing. The CVSS score is 6.5, indicating a medium severity impact.

IBM i versions 7.3 through 7.6 contain a stack-based buffer overflow vulnerability in the Native IBM i JSSE provider due to improper bounds checking during TLS session establishment. A local authenticated attacker could exploit this to overflow a fixed-length buffer, potentially executing arbitrary code or causing the JVM process to crash. The vulnerability is identified as CWE-787 and has a CVSS 3.1 base score of 7.3, indicating high severity.

CVE-2026-18509 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a local authenticated attacker to escalate privileges via the Navigator for i debugger. Exploitation could lead to unauthorized access or manipulation of sensitive data and creation of new profiles with elevated privileges on the affected IBM i systems.

CVE-2026-18249 is a high-severity vulnerability in IBM i versions 7.3 through 7.6. It involves improper privilege management due to insufficient validation of pointers read from Java-controlled addresses, allowing a remote authenticated attacker to gain elevated privileges.

CVE-2026-18193 is a high severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses. This improper privilege management flaw can lead to a complete compromise of confidentiality and integrity, with limited impact on availability.

CVE-2026-18101 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper privilege management where a local attacker could gain elevated privileges due to incorrect handling of thread authority swaps. The vulnerability has a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet by IBM. There are no known exploits in the wild at this time.

CVE-2026-18086 is a medium severity vulnerability in IBM i versions 7.3 through 7.6. It involves an out-of-bounds write due to improper bounds checking, which could allow a local attacker to execute arbitrary code or cause a denial of service.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.

CVE-2026-18068 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a confusion between byte-count and element-count that could allow a remote attacker with limited privileges to obtain sensitive information. The vulnerability does not impact integrity or availability and does not require user interaction. No official patch or remediation guidance is currently confirmed.

CVE-2026-18020 is an out-of-bounds read vulnerability (CWE-125) affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. The flaw is caused by an off-by-one error in bounds checking, which could be exploited by a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but can affect availability. The CVSS score is 5.3, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability due to an out-of-bounds read that could allow a remote attacker to obtain sensitive information. The vulnerability is identified as CWE-125 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-17502 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves an out-of-bounds write that could be exploited remotely to cause a denial of service. The vulnerability does not require user interaction or privileges to exploit. No official patch or remediation information is currently available.

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.

IBM Documentation Offline versions 1.0.0 through 1.4.1 contain a vulnerability due to improper output neutralization for logs (CWE-117). This flaw could allow a remote attacker to execute arbitrary code without requiring privileges or user interaction. The vulnerability has a high severity with a CVSS score of 8.8. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-17476 is an out-of-bounds write vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. This flaw could allow a remote attacker to cause a denial of service by improperly writing to a buffer. The vulnerability has a medium severity rating with a CVSS score of 4.8.

IBM Documentation Offline versions 1.0.0 through 1.4.1 contain a path traversal vulnerability that allows remote attackers to read arbitrary files. This occurs due to improper limitation of pathnames to restricted directories. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation guidance is currently provided by the vendor.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.