Threats affecting pkg:maven/com.ibm/cloud_pak_for_business_automation

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.4%	CVE-2026-11864IBM Cloud Pak for Business Automation · XPath Injection Medium6.5EPSS 0.4%2026-09-15CVE Database V5CVE-2026-11864 IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document. EPSS 0.4%Vulnerability CWE-643	CVE Database V5	2026-09-15
Medium	5.4	EPSS 0.3%	CVE-2026-12751IBM Cloud Pak for Business Automation · Basic XSS Medium5.4EPSS 0.3%2026-09-15CVE Database V5CVE-2026-12751 IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. EPSS 0.3%Vulnerability CWE-80	CVE Database V5	2026-09-15

Page 1 of 1