CVE-2026-15069
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0. A remote attacker can execute arbitrary script code due to improper input neutralization during web page generation (XSS).
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, leading to session theft, defacement, or other attacks.
Recommendation
Apply the IBM patch for affected versions. Sanitize input and implement Content Security Policy.
Other vulnerabilities in IBM Engineering AI Hub
See all- CVE-2026-15091Critical
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 do not properly neutralize input during web page generation, allowing remote attackers to execute arbitrary scripts (XSS).
- CVE-2026-15322High
Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allows a remote attacker to obtain sensitive information due to exposure of session tokens in URLs.
- CVE-2026-15093Medium
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs.
Original NVD description (English source)
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation.