CVE-2026-15091

CriticalCVSS 9.3

Published: 17/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 do not properly neutralize input during web page generation, allowing remote attackers to execute arbitrary scripts (XSS).

Risk Assessment

An attacker could inject malicious scripts, leading to session theft, defacement, or other attacks on users.

Recommendation

Update IBM Engineering AI Hub to the latest patched version.

Original NVD description (English source)

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation.