IBM vulnerabilities

6,267 published CVEs name IBM among the affected products; CISA lists 6 of them as exploited in the wild.

Critical 333High 1,546Medium 4,034Low 354Not scored 0

CVEs per yearBy the year they were published

CVE-2026-9198
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
IBM · Langflow OSS
ExploitedCritical9.8
CVE-2022-47986
IBM Aspera Faspex code execution
IBM · Aspera Faspex
ExploitedCritical9.8
CVE-2020-4430
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send…
IBM · Data Risk Manager
ExploitedMedium4.3
CVE-2020-4428
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID:…
IBM · Data Risk Manager
ExploitedCritical9.1
CVE-2020-4427
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML…
IBM · Data Risk Manager
ExploitedCritical9.0
CVE-2019-4716
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute…
IBM · Planning Analytics
ExploitedCritical10.0

CVE-2026-118904
IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication.
IBM · webMethods Integration Server
High8.1
CVE-2026-96146
Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management
IBM · SevOne Network Performance Management
High7.5
CVE-2026-95867
Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management
IBM · SevOne Network Performance Management
Medium6.7
CVE-2026-17427
This Power System update is being released to address
IBM · OPENBMC
Medium6.5
CVE-2026-17426
This Power System update is being released to address
IBM · OPENBMC
Medium6.5
CVE-2026-16697
This Power System update is being released to address
IBM · OPENBMC
Medium6.5
CVE-2026-16682
This Power System update is being released to address
IBM · OPENBMC
Medium6.5
CVE-2026-97677
Langflow OSS is affected by multiple vulnerabilities
IBM · Langflow OSS
High8.1
CVE-2026-9764
IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution
IBM · Bob Shell
High8.8
CVE-2026-93879
Hibernate Validator is affected by an expression language injection vulnerability
IBM · Hibernate Validator
High7.5