Threat database

IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.

IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains a critical improper authorization vulnerability (CWE-285) that allows unauthenticated users to write arbitrarily into a shared Redis cache under any tenant's key. This flaw breaks the credential-encryption boundary of the platform and enables anonymous attackers to poison cached flow parameters for any tenant.

IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type.

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.

CVE-2026-93441 is a high-severity vulnerability in IBM QRadar Security Information and Event Management (SIEM) that allows a remote attacker to cause a denial of service by triggering uncontrolled resource consumption. The affected versions include 7.4-20210823144546 through 7.5-20260930064858 and 7.6-20260330053257 through 7.6-20260930064910. This vulnerability does not impact confidentiality or integrity but severely affects availability.

IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.

IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.

IBM Carbon Charts versions 0.4.0 through 1.27.19 contain a cross-site scripting (XSS) vulnerability in the MeterChart component. The issue arises because the Title.truncateTitle() function unsafely inserts a substring of user-provided label text into the DOM using innerHTML without proper sanitization. This allows remote attackers to execute arbitrary JavaScript in the context of the victim's browser session. The vulnerability has a medium severity rating with a CVSS score of 6.1.

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters.

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources.

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.