CVE-2026-15091
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 do not properly neutralize input during web page generation, allowing remote attackers to execute arbitrary scripts (XSS).
Risk Assessment
An attacker could inject malicious scripts, leading to session theft, defacement, or other attacks on users.
Recommendation
Update IBM Engineering AI Hub to the latest patched version.
Other vulnerabilities in IBM Engineering AI Hub
See all- CVE-2026-15322High
Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allows a remote attacker to obtain sensitive information due to exposure of session tokens in URLs.
- CVE-2026-15093Medium
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs.
- CVE-2026-15069Medium
Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0. A remote attacker can execute arbitrary script code due to improper input neutralization during web page generation (XSS).
Original NVD description (English source)
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation.