Skip to content
OpenAdvisories

Vendor

IBM

6,555 known vulnerabilities.

Products

API Connect 287 AIX 217 i 213 WebSphere Application Server 188 DB2 for Linux, UNIX and Windows 182 Langflow OSS 177 InfoSphere Information Server 152 PowerVM VIOS 146 Sterling B2B Integrator 138 Rational Collaborative Lifecycle Management 131 Rational Quality Manager 126 MQ 117 QRadar SIEM 113 Security Guardium 106 Cognos Analytics 105 Guardium Data Protection 97 Rational DOORS Next Generation 96 Security Verify Access 93 Maximo Asset Management 86 WebSphere Application Server - Liberty 86 Rational Engineering Lifecycle Manager 76 Rational Team Concert 72 Sterling File Gateway 71 DataStage on Cloud Pak for Data 65 Security Verify Access Container 65 Concert 64 Verify Identity Access 59 Verify Identity Access Container 59 Security Key Lifecycle Manager 57 Db2 56 Cloud Pak for Security 55 Cognos Controller 52 Engineering Lifecycle Optimization 52 UrbanCode Deploy 52 Spectrum Protect Plus 49 Spectrum Scale 48 Engineering Workflow Management 48 Rational Rhapsody Design Manager 47 Financial Transaction Manager (FTM) for RedHat OpenShift 46 Robotic Process Automation 45
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-123218 Exploited Public exploit

    IBM Aspera Faspex Authorization Bypass

    IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

    IBM Aspera Faspex
    KEV Nov 9, 2026
  • Critical 9.8
    CVE-2026-93680 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-107327 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-107328 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-107329 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-110186 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-93674 Public exploit Scanner template EPSS 15%

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-19295 Public exploit

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allo…

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-19286 Public exploit

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-12118 Public exploit

    IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

    IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

    IBM webMethods Integration (on prem)
  • Critical 9.8
    CVE-2026-12940 Public exploit

    Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

    IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGER…

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-9198 Exploited Public exploit Scanner template EPSS 29%

    Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

    IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

    IBM Langflow OSS
    KEV Aug 4, 2026
  • Critical 10.0
    CVE-2026-10134 Public exploit

    Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

    IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abu…

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-7873 Public exploit Scanner template

    Code Injection Vulnerability in Code Validation Endpoint

    IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

    IBM Langflow OSS langflow PyPI
  • Critical 9.1
    CVE-2023-27290 Public exploit

    IBM Observability with Instana missing authentication

    Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write acces…

    IBM Observability with Instana
  • Critical 9.8
    CVE-2022-47986 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    IBM Aspera Faspex code execution

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to e…

    IBM Aspera Faspex
    KEV Feb 21, 2023
  • Critical 9.1
    CVE-2020-4428 Exploited Public exploit EPSS 62%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary c…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-4429 Public exploit Scanner template EPSS 72%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrati…

    IBM Data Risk Manager
  • Critical 9.0
    CVE-2020-4427 Exploited Public exploit Scanner template EPSS 70%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2019-4716 Exploited Public exploit Scanner template EPSS 86%

    IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated us…

    IBM Planning Analytics
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2019-4279 Public exploit EPSS 80%

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with…

    IBM WebSphere Application Server
  • Critical 9.0
    CVE-2019-4013 Public exploit EPSS 13%

    IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root p…

    IBM BigFix Platform