Vendor
IBM
11,014 known vulnerabilities in products by IBM, 18 of them actively exploited (CISA KEV).
Key figures
11,014
Vulnerabilities
18
Actively exploited (KEV)
3
Used by ransomware
734
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2022-47986 | IBM Aspera Faspex code execution In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2017-5638 | Apache Struts Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2026-9198 | Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation In CISA KEV | 9.8 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2026-34197 | Apache ActiveMQ Improper Input Validation Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2019-4716 | IBM Planning Analytics Remote Code Execution Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2014-6271 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2014-7169 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2015-7450 | IBM WebSphere Application Server and Server Hypervisor Edition: Code Injection In CISA KEV | 9.8 | |
| Critical | CVE-2022-0492 | Linux Kernel Improper Authentication Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2013-3993 | IBM InfoSphere BigInsights Invalid Input Vulnerability In CISA KEVRansomware | 6.5 | |
| Critical | CVE-2020-4428 | IBM Data Risk Manager Remote Code Execution Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2020-4427 | IBM Data Risk Manager Security Bypass Vulnerability In CISA KEV | 9.0 | |
| Critical | CVE-2026-31431 | Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2023-0266 | Linux Kernel Use-After-Free Vulnerability In CISA KEV | 7.9 | |
| Critical | CVE-2020-4430 | IBM Data Risk Manager Directory Traversal Vulnerability In CISA KEV | 4.3 | |
| Critical | CVE-2026-53266 | Linux Kernel Out-of-Bounds Write Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2026-66066 | Rails: Initialization of a Resource with an Insecure Default | — | |
| Critical | CVE-2025-68615 | Net-SNMP snmptrapd crash | 9.8 | |
| High | CVE-2025-1094 | PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation | 8.1 | |
| Critical | CVE-2026-93674 | Langflow OSS is affected by multiple vulnerabilities | 9.8 | |
| Critical | CVE-2007-4559 | Python Software Foundation CPython: Path Traversal | 9.8 | |
| Critical | CVE-2024-5535 | SSL_select_next_proto buffer overread | 9.1 | |
| High | CVE-2026-43284 | Linux Kernel: security vulnerability | 8.8 |
News
- October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero dayscsoonline,
- 58 hardware vulnerabilities: A guide to the threatscsoonline,
- NCSC-2026-0392 [1.00] [M/H] Kwetsbaarheden verholpen in IBM Langflow OSS en IBM MQ Appliancencsc-nl,
- NCSC-2026-0377 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Enterprise Managerncsc-nl,
- Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activitythehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,