Threat database

CVE-2026-78673 is a high severity vulnerability in IBM Maximo AI Service versions 9.1.0 and 9.2.0. It involves improper input validation that could allow a remote attacker to cause a denial of service (DoS). No confidentiality or integrity impact is reported. There are no known exploits in the wild, and no patch information is provided.

CVE-2026-105052 is a path traversal vulnerability in IBM Maximo Application Suite versions 8.10, 8.11, 9.0, 9.1, and 9.2. It allows a remote attacker to send specially crafted URL requests containing directory traversal sequences (/../) to access arbitrary files on the system. This vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation information is provided in the available data.

CVE-2026-16678 is a medium severity vulnerability in IBM Virtualization Management Interface firmware versions FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81. It involves improper resource management that could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a stack-based buffer overflow vulnerability in the host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can exploit this by supplying crafted configuration data, causing the host firmware boot stack to crash and potentially corrupt memory during system initialization. This leads to integrity and availability impacts on the managed system.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a stack-based buffer overflow vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can exploit this flaw by sending a specially crafted mailbox message, leading to arbitrary code execution within the host firmware runtime. This vulnerability allows full access to the managed system's memory and hardware interfaces, impacting confidentiality, integrity, and availability.

A stack-based buffer overflow vulnerability (CWE-121) exists in IBM Power Systems Firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81. The flaw is in the host firmware boot process image validation path. An attacker with service processor access can supply a malicious code update image, enabling arbitrary code execution on the host system. This can compromise confidentiality, integrity, and availability of the affected host.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a stack-based buffer overflow vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can exploit this flaw by sending a specially crafted mailbox message, leading to arbitrary code execution within the host firmware runtime. This vulnerability compromises the confidentiality, integrity, and availability of the managed system by granting full access to system memory and hardware interfaces.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can send crafted mailbox messages to read or modify arbitrary Hostboot memory regions. This compromises the host firmware boot stack and the hypervisor loaded by it, impacting confidentiality, integrity, and availability of the managed system.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a stack-based buffer overflow vulnerability in the host firmware configuration parsing. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can supply crafted configuration data that causes memory corruption during the system Initial Program Load (IPL). This corruption affects the host firmware boot stack and the hypervisor loaded afterward, leading to potential compromise of confidentiality, integrity, and availability of the managed system.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a critical privilege escalation vulnerability. An authenticated attacker can bypass authorization and input validation checks to execute malicious code and gain elevated privileges on the system. This vulnerability is identified as CWE-264 and has a CVSS 3.1 score of 9.9, indicating a severe impact on confidentiality, integrity, and availability.

CVE-2026-104364 is a vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. It involves improper input validation that could allow a local attacker to cause a denial of service. The vulnerability has a low severity rating and a CVSS score of 3.3. No information about patches or exploits in the wild is currently available.

A stack-based buffer overflow vulnerability exists in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. This flaw can be triggered by executing a specially crafted query involving a Materialized Query Table, resulting in a denial of service condition.

IBM DB2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 contains a cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript into the web user interface, potentially altering its behavior and leading to credential disclosure within a trusted session. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level.

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 contains a cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript into the web user interface, potentially altering functionality and leading to credential disclosure within a trusted session. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level.

IBM Db2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 contains a cross-site scripting (XSS) vulnerability. This flaw allows an unauthenticated attacker to inject arbitrary JavaScript code into the web user interface, potentially altering its intended functionality. Exploitation could lead to disclosure of credentials within a trusted session. The vulnerability has a CVSS v3.1 base score of 6.1, indicating a medium severity level. No specific affected versions beyond 5.5 IF 2 are stated, and no patch or remediation information is provided.

CVE-2025-27902 is a medium severity vulnerability in IBM DB2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2. It involves the use of a web link to an untrusted external target with window.opener access, which could allow a remote attacker to expose sensitive information or perform unauthorized actions in the victim's web browser.

CVE-2026-18166 is a high severity vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows. It involves improper access control related to the CREATE WRAPPER command, allowing a remote authenticated attacker to obtain sensitive information without user interaction.

CVE-2026-105464 is a high-severity vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows. It involves improper privilege management that could allow a local attacker to gain elevated privileges without user interaction. The vulnerability affects Db2 and Db2 Connect Server components.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a vulnerability that can lead to denial of service when inserting data into tables with XML columns under specific conditions. This issue is due to allocation of resources without limits or throttling. The vulnerability has a medium severity rating with a CVSS score of 6.5.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a high-severity privilege escalation vulnerability (CWE-269) when the db2locssh feature is enabled with the Db2 instance. This vulnerability allows an attacker with limited privileges to escalate their privileges, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.