CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Langflow OSS versions 1.0.0 through 1.10.2 may allow a remote authenticated attacker to change the password of an account due to improper authentication.
IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols.
IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) may allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 may allow a remote attacker to obtain sensitive information due to improper request validation.
IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) may allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains improper neutralization of special characters in the PxPeek name property. A remote authenticated attacker could exploit this to execute arbitrary OS commands.
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to OS command injection. A remote authenticated attacker could exploit this to execute arbitrary commands.
IBM WebSphere Application Server versions 9.0 and 8.5 are affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.
The PxXMLInput operator in IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to XML external entity (XXE) injection. A remote authenticated attacker could exploit this to obtain sensitive information.
IBM DataStage on Cloud Pak for Data 5.4.0.0 has an improper configuration of the XSLT transformation engine. A remote authenticated attacker could exploit this to execute arbitrary code.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability. A remote authenticated attacker could exploit this to read, write, or delete arbitrary files.
IBM WebSphere Application Server 9.0 and 8.5 is affected by an authorization bypass vulnerability. The flaw allows access to resources without required permissions.
IBM WebSphere Application Server versions 9.0 and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.
IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.
IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request.
IBM WebSphere Application Server 9.0 and 8.5 is affected by a reflected cross-site scripting vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS