CVE-2026-19620

IBM Planning Analytics 2.0 and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

IBM Planning Analytics 2.0 and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.

IBM Planning Analytics 2.0 and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing 'dot dot' sequences (/../) to write arbitrary files on the system.

IBM Planning Analytics 2.0 and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

IBM Planning Analytics 2.0 and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

IBM Planning Analytics 2.0 and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM Planning Analytics 2.0 and 2.1 contain an improper functional level access control flaw. A remote authenticated attacker can delete folders and applications belonging to other users.

IBM Planning Analytics 2.0 and 2.1 Local is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.