CVE records
39770 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.
| CVE | Title | Published | Top score | KEV |
|---|---|---|---|---|
| CVE-2026-82102 | DataStage on Cloud Pak for Data has vulnerabilities due to open source software | 13 Nov 2026 | 6.4 | |
| CVE-2026-91868 | IBM Security QRadar EDR Improper Access Control | 13 Nov 2026 | 6.5 | |
| CVE-2026-91869 | IBM Security QRadar EDR Improper Restriction of Excessive Authentication Attempts | 13 Nov 2026 | 8.1 | |
| CVE-2026-109158 | IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File | 13 Nov 2026 | 7.5 | |
| CVE-2026-115788 | IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Log Forging | 13 Nov 2026 | 8.1 | |
| CVE-2025-43874 | 13 Nov 2026 | 8.7 | ||
| CVE-2026-114468 | IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Hard-coded Credentials | 13 Nov 2026 | 6.0 | |
| CVE-2025-53700 | 13 Nov 2026 | 6.3 | ||
| CVE-2026-5514 | IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information | 13 Nov 2026 | 3.3 | |
| CVE-2025-53699 | 13 Nov 2026 | 7.0 | ||
| CVE-2026-123628 | IBM webMethods Integration Server is vulnerable to sensitive information disclousure via admin/server/env API request. | 13 Nov 2026 | 7.5 | |
| CVE-2025-53698 | 13 Nov 2026 | 7.0 | ||
| CVE-2026-115501 | IBM i is Affected By A Buffer Overflow Vulnerability in QFileSvr.400 File System [] | 13 Nov 2026 | 5.3 | |
| CVE-2026-110194 | IBM ContextForge MCP Gateway is affected by a server-side request forgery vulnerability | 13 Nov 2026 | 5.4 | |
| CVE-2026-110178 | IBM ContextForge MCP Gateway is affected by an improper access control vulnerability in configuration import | 13 Nov 2026 | 4.1 | |
| CVE-2026-110199 | IBM ContextForge MCP Gateway is affected by a DOM-based cross-site scripting | 13 Nov 2026 | 4.8 | |
| CVE-2026-110279 | IBM ContextForge MCP Gateway is affected by an improper authentication vulnerability | 13 Nov 2026 | 8.1 | |
| CVE-2026-94407 | IBM ContextForge MCP Gateway is affected by a regular expression denial of service | 13 Nov 2026 | 6.5 | |
| CVE-2026-110189 | IBM ContextForge MCP Gateway is affected by a denial of service due to an incomplete list of disallowed jq inputs | 13 Nov 2026 | 6.5 | |
| CVE-2026-110195 | IBM ContextForge MCP Gateway is affected by an authorization bypass vulnerability | 13 Nov 2026 | 5.4 | |
| CVE-2026-124021 | Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes | 13 Nov 2026 | 9.2 | |
| CVE-2026-110278 | IBM ContextForge MCP Gateway is affected by an information exposure vulnerability | 13 Nov 2026 | 7.4 | |
| CVE-2026-124020 | Control Web Panel < 1.30.6 Host Header Password Reset Poisoning | 13 Nov 2026 | 9.2 | |
| CVE-2026-128886 | Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path | 13 Nov 2026 | 6.2 | |
| CVE-2026-9661 | Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path | 13 Nov 2026 | 7.3 | |
| CVE-2025-53697 | 13 Nov 2026 | 8.4 | ||
| CVE-2026-97683 | IBM Cyber Fraud includes components with multiple known vulnerabilities | 13 Nov 2026 | 2.5 | |
| CVE-2026-9870 | IBM Cyber Fraud includes components with multiple known vulnerabilities | 13 Nov 2026 | 6.1 | |
| CVE-2026-108290 | IBM Cyber Fraud includes components with multiple known vulnerabilities | 13 Nov 2026 | 4.0 | |
| CVE-2026-9821 | IBM Cyber Fraud includes components with multiple known vulnerabilities | 13 Nov 2026 | 5.3 | |
| CVE-2026-110330 | Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ | 13 Nov 2026 | 5.5 | |
| CVE-2026-110331 | Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element | 13 Nov 2026 | 7.8 | |
| CVE-2026-129137 | 13 Nov 2026 | |||
| CVE-2026-19194 | CAP JWT claims validation bypass using non-canonical claim names | 13 Nov 2026 | 5.9 | |
| CVE-2026-102632 | 13 Nov 2026 | |||
| CVE-2026-128987 | Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations | 13 Nov 2026 | 6.2 | |
| CVE-2026-128885 | Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize | 13 Nov 2026 | 5.5 | |
| CVE-2026-127217 | Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route | 13 Nov 2026 | 6.4 | |
| CVE-2026-82504 | VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx | 13 Nov 2026 | 9.8 | |
| CVE-2026-128132 | AIOHTTP: WebSocket receive queue limits bypassed by small or compressed messages | 13 Nov 2026 | 8.7 | |
| CVE-2026-127216 | Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure | 13 Nov 2026 | 7.1 | |
| CVE-2026-128131 | AIOHTTP: Concatenated compressed streams cause excessive CPU use | 13 Nov 2026 | 8.7 | |
| CVE-2026-128130 | AIOHTTP: Pure-Python parser request replay and buffer growth behind a declined upgrade | 13 Nov 2026 | 8.3 | |
| CVE-2026-128129 | AIOHTTP: Unbounded buffering of data received during an upgrade request | 13 Nov 2026 | 8.2 | |
| CVE-2026-128128 | AIOHTTP: WebSocket max_msg_size bypass via integer overflow | 13 Nov 2026 | 7.5 | |
| CVE-2026-128127 | AIOHTTP: Base64 multipart parts bypass client_max_size | 13 Nov 2026 | 8.7 | |
| CVE-2026-128126 | AIOHTTP: Too many URL-encoded form fields block the event loop | 13 Nov 2026 | 8.7 | |
| CVE-2026-89037 | Dolibarr < 24.0.2 IDOR via Ticket Documents API | 13 Nov 2026 | 7.1 | |
| CVE-2026-128125 | AIOHTTP: Unbounded cookie storage in client CookieJar | 13 Nov 2026 | 6.3 | |
| CVE-2026-92738 | Expired Vault login MFA requests may remain redeemable | 13 Nov 2026 | 6.8 |