{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: IBM vulnerabilities","home_page_url":"https://patchfirst.co/vendor/ibm/","feed_url":"https://patchfirst.co/feed/vendor/ibm.json","description":"New and newly exploited IBM CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-93680","url":"https://patchfirst.co/cve/CVE-2026-93680/","title":"CVE-2026-93680: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 2.3% (higher than 83% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 29.1 of 100.","summary":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T18:18:20.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":29.1,"kev":null,"epss":{"score":0.02265,"percentile":0.82991},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-104339","url":"https://patchfirst.co/cve/CVE-2026-104339/","title":"CVE-2026-104339: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 0.7% (higher than 54.8% of CVEs). CVSS 9.8 CRITICAL. Priority 18.5 of 100.","summary":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T13:29:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.5,"kev":null,"epss":{"score":0.00748,"percentile":0.54841},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-110186","url":"https://patchfirst.co/cve/CVE-2026-110186/","title":"CVE-2026-110186: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control…","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 9.8 CRITICAL. Priority 17.5 of 100.","summary":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T18:17:19.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.5,"kev":null,"epss":{"score":0.00622,"percentile":0.49784},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-104317","url":"https://patchfirst.co/cve/CVE-2026-104317/","title":"CVE-2026-104317: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute…","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 0.6% (higher than 47.4% of CVEs). CVSS 9.8 CRITICAL. Priority 17.0 of 100.","summary":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T18:17:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17,"kev":null,"epss":{"score":0.00573,"percentile":0.47354},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-18894","url":"https://patchfirst.co/cve/CVE-2026-18894/","title":"CVE-2026-18894: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 0.4% (higher than 37% of CVEs). CVSS 9.8 CRITICAL. Priority 14.9 of 100.","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T13:23:56.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.9,"kev":null,"epss":{"score":0.00427,"percentile":0.36966},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-92559","url":"https://patchfirst.co/cve/CVE-2026-92559/","title":"CVE-2026-92559: IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due…","content_text":"IBM · App Connect Enterprise. Not in CISA KEV. EPSS 0.5% (higher than 44.8% of CVEs). CVSS 9.8 CRITICAL. Priority 17.7 of 100.","summary":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due…","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-23T12:18:18.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.7,"kev":null,"epss":{"score":0.0053,"percentile":0.44808},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"App Connect Enterprise","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-81212","url":"https://patchfirst.co/cve/CVE-2026-81212/","title":"CVE-2026-81212: IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared…","content_text":"IBM · DataStage on Cloud Pak for Data. Not in CISA KEV. EPSS 0.3% (higher than 18.8% of CVEs). CVSS 10.0 CRITICAL. Priority 12.7 of 100.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared…","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-28T16:17:09.000Z","tags":[],"_patchfirst":{"reason":"published","priority":12.7,"kev":null,"epss":{"score":0.00267,"percentile":0.18849},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataStage on Cloud Pak for Data","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-12665","url":"https://patchfirst.co/cve/CVE-2026-12665/","title":"CVE-2026-12665: IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS…","content_text":"IBM · MQ Operator. Not in CISA KEV. EPSS 0.3% (higher than 24.5% of CVEs). CVSS 9.8 CRITICAL. Priority 13.5 of 100.","summary":"IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS…","date_published":"2026-10-19T00:00:00.000Z","date_modified":"2026-10-23T17:21:42.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.5,"kev":null,"epss":{"score":0.00315,"percentile":0.24477},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"MQ Operator","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-53709","url":"https://patchfirst.co/cve/CVE-2026-53709/","title":"CVE-2026-53709: MCP Context Forge is an MCP gateway and administrative platform","content_text":"IBM · mcp-context-forge. Not in CISA KEV. EPSS 0.6% (higher than 48.8% of CVEs). CVSS 9.8 CRITICAL. Priority 18.8 of 100.","summary":"MCP Context Forge is an MCP gateway and administrative platform","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-16T22:17:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.8,"kev":null,"epss":{"score":0.00603,"percentile":0.48841},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"mcp-context-forge","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-96119","url":"https://patchfirst.co/cve/CVE-2026-96119/","title":"CVE-2026-96119: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute…","content_text":"IBM · i. Not in CISA KEV. EPSS 0.5% (higher than 44.1% of CVEs). CVSS 9.9 CRITICAL. Priority 17.9 of 100.","summary":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-14T23:48:20.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.9,"kev":null,"epss":{"score":0.00519,"percentile":0.44112},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"i","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-93895","url":"https://patchfirst.co/cve/CVE-2026-93895/","title":"CVE-2026-93895: IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker…","content_text":"IBM · WebSphere Application Server - Liberty. Not in CISA KEV. EPSS 0.4% (higher than 33.6% of CVEs). CVSS 9.1 CRITICAL. Priority 15.3 of 100.","summary":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-22T18:55:12.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.3,"kev":null,"epss":{"score":0.00394,"percentile":0.33628},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"WebSphere Application Server - Liberty","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-93909","url":"https://patchfirst.co/cve/CVE-2026-93909/","title":"CVE-2026-93909: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass…","content_text":"IBM · WebSphere Application Server - Liberty. Not in CISA KEV. EPSS 0.3% (higher than 27.1% of CVEs). CVSS 9.1 CRITICAL. Priority 13.9 of 100.","summary":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-22T18:56:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00337,"percentile":0.27062},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"WebSphere Application Server - Liberty","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-95695","url":"https://patchfirst.co/cve/CVE-2026-95695/","title":"CVE-2026-95695: IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass…","content_text":"IBM · WebSphere Application Server - Liberty. Not in CISA KEV. EPSS 0.3% (higher than 25.4% of CVEs). CVSS 9.1 CRITICAL. Priority 13.6 of 100.","summary":"IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-22T17:34:56.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.6,"kev":null,"epss":{"score":0.00323,"percentile":0.25377},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"WebSphere Application Server - Liberty","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-90920","url":"https://patchfirst.co/cve/CVE-2026-90920/","title":"CVE-2026-90920: IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control…","content_text":"IBM · Maximo AI Service. Not in CISA KEV. EPSS 0.5% (higher than 45.6% of CVEs). CVSS 9.8 CRITICAL. Priority 18.2 of 100.","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control…","date_published":"2026-10-12T00:00:00.000Z","date_modified":"2026-10-13T16:17:14.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.2,"kev":null,"epss":{"score":0.00544,"percentile":0.45637},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Maximo AI Service","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-82110","url":"https://patchfirst.co/cve/CVE-2026-82110/","title":"CVE-2026-82110: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due…","content_text":"IBM · DataStage on Cloud Pak for Data. Not in CISA KEV. EPSS 0.5% (higher than 43.9% of CVEs). CVSS 9.9 CRITICAL. Priority 17.9 of 100.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due…","date_published":"2026-10-12T00:00:00.000Z","date_modified":"2026-10-14T23:50:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.9,"kev":null,"epss":{"score":0.00515,"percentile":0.43868},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataStage on Cloud Pak for Data","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-82101","url":"https://patchfirst.co/cve/CVE-2026-82101/","title":"CVE-2026-82101: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service…","content_text":"IBM · DataStage on Cloud Pak for Data. Not in CISA KEV. EPSS 0.4% (higher than 35.9% of CVEs). CVSS 9.6 CRITICAL. Priority 16.1 of 100.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service…","date_published":"2026-10-12T00:00:00.000Z","date_modified":"2026-10-14T23:51:06.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.1,"kev":null,"epss":{"score":0.00416,"percentile":0.35933},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataStage on Cloud Pak for Data","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-19622","url":"https://patchfirst.co/cve/CVE-2026-19622/","title":"CVE-2026-19622: IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due…","content_text":"IBM · Planning Analytics. Not in CISA KEV. EPSS 0.3% (higher than 28.6% of CVEs). CVSS 9.8 CRITICAL. Priority 14.7 of 100.","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due…","date_published":"2026-10-12T00:00:00.000Z","date_modified":"2026-10-15T18:14:24.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.7,"kev":null,"epss":{"score":0.00349,"percentile":0.28565},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Planning Analytics","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-96012","url":"https://patchfirst.co/cve/CVE-2026-96012/","title":"CVE-2026-96012: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation","content_text":"IBM · Db2 Mirror for i. Not in CISA KEV. EPSS 0.3% (higher than 24.2% of CVEs). CVSS 9.9 CRITICAL. Priority 13.9 of 100.","summary":"IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation","date_published":"2026-10-12T00:00:00.000Z","date_modified":"2026-10-13T16:17:14.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00312,"percentile":0.24163},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Db2 Mirror for i","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-78401","url":"https://patchfirst.co/cve/CVE-2026-78401/","title":"CVE-2026-78401: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a…","content_text":"IBM · Security Verify Access. Not in CISA KEV. EPSS 0.8% (higher than 55.9% of CVEs). CVSS 9.8 CRITICAL. Priority 20.6 of 100.","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-10T13:17:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.6,"kev":null,"epss":{"score":0.0078,"percentile":0.55903},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Security Verify Access","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-78406","url":"https://patchfirst.co/cve/CVE-2026-78406/","title":"CVE-2026-78406: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a…","content_text":"IBM · Security Verify Access. Not in CISA KEV. EPSS 0.8% (higher than 55% of CVEs). CVSS 9.8 CRITICAL. Priority 20.4 of 100.","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-10T04:18:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.4,"kev":null,"epss":{"score":0.00753,"percentile":0.55027},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Security Verify Access","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-75875","url":"https://patchfirst.co/cve/CVE-2026-75875/","title":"CVE-2026-75875: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.6% (higher than 48.3% of CVEs). CVSS 9.8 CRITICAL. Priority 19.0 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:35:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19,"kev":null,"epss":{"score":0.00592,"percentile":0.48283},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-15762","url":"https://patchfirst.co/cve/CVE-2026-15762/","title":"CVE-2026-15762: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","content_text":"IBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.5% (higher than 44.6% of CVEs). CVSS 9.8 CRITICAL. Priority 18.3 of 100.","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-15T00:02:35.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.3,"kev":null,"epss":{"score":0.00527,"percentile":0.44639},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6CD","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-16340","url":"https://patchfirst.co/cve/CVE-2026-16340/","title":"CVE-2026-16340: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","content_text":"IBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.5% (higher than 42% of CVEs). CVSS 9.8 CRITICAL. Priority 17.8 of 100.","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-15T00:02:49.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.8,"kev":null,"epss":{"score":0.00489,"percentile":0.42046},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6CD","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-14269","url":"https://patchfirst.co/cve/CVE-2026-14269/","title":"CVE-2026-14269: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","content_text":"IBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.5% (higher than 41.8% of CVEs). CVSS 9.8 CRITICAL. Priority 17.7 of 100.","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T23:59:01.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.7,"kev":null,"epss":{"score":0.00486,"percentile":0.41805},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6CD","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-84249","url":"https://patchfirst.co/cve/CVE-2026-84249/","title":"CVE-2026-84249: IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 36.3% of CVEs). CVSS 9.8 CRITICAL. Priority 16.6 of 100.","summary":"IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-15T17:08:47.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.6,"kev":null,"epss":{"score":0.0042,"percentile":0.36277},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-14991","url":"https://patchfirst.co/cve/CVE-2026-14991/","title":"CVE-2026-14991: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","content_text":"IBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.4% (higher than 36.1% of CVEs). CVSS 9.8 CRITICAL. Priority 16.6 of 100.","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-15T00:02:42.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.6,"kev":null,"epss":{"score":0.00417,"percentile":0.36053},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6CD","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-84272","url":"https://patchfirst.co/cve/CVE-2026-84272/","title":"CVE-2026-84272: IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 34.4% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.","summary":"IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-10T13:17:33.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.3,"kev":null,"epss":{"score":0.00401,"percentile":0.34373},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-82344","url":"https://patchfirst.co/cve/CVE-2026-82344/","title":"CVE-2026-82344: IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 34.7% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-10T04:18:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.3,"kev":null,"epss":{"score":0.00405,"percentile":0.34715},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-14502","url":"https://patchfirst.co/cve/CVE-2026-14502/","title":"CVE-2026-14502: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","content_text":"IBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.4% (higher than 33.9% of CVEs). CVSS 9.8 CRITICAL. Priority 16.2 of 100.","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T23:58:22.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.2,"kev":null,"epss":{"score":0.00397,"percentile":0.33887},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6CD","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-84057","url":"https://patchfirst.co/cve/CVE-2026-84057/","title":"CVE-2026-84057: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.8% of CVEs). CVSS 9.8 CRITICAL. Priority 15.9 of 100.","summary":"IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:28:40.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.9,"kev":null,"epss":{"score":0.00387,"percentile":0.32787},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-84246","url":"https://patchfirst.co/cve/CVE-2026-84246/","title":"CVE-2026-84246: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:36:29.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00381,"percentile":0.32125},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-84198","url":"https://patchfirst.co/cve/CVE-2026-84198/","title":"CVE-2026-84198: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-15T00:05:28.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00381,"percentile":0.32125},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-84035","url":"https://patchfirst.co/cve/CVE-2026-84035/","title":"CVE-2026-84035: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:29:59.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00381,"percentile":0.32124},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-82895","url":"https://patchfirst.co/cve/CVE-2026-82895/","title":"CVE-2026-82895: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:33:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00381,"percentile":0.32125},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-82335","url":"https://patchfirst.co/cve/CVE-2026-82335/","title":"CVE-2026-82335: IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-10T04:18:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00381,"percentile":0.32125},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-14888","url":"https://patchfirst.co/cve/CVE-2026-14888/","title":"CVE-2026-14888: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","content_text":"IBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T19:58:08.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00381,"percentile":0.32126},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6CD","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-84058","url":"https://patchfirst.co/cve/CVE-2026-84058/","title":"CVE-2026-84058: IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server)…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 31.8% of CVEs). CVSS 9.8 CRITICAL. Priority 15.7 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server)…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.7,"kev":null,"epss":{"score":0.00378,"percentile":0.31764},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-82900","url":"https://patchfirst.co/cve/CVE-2026-82900/","title":"CVE-2026-82900: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.2% of CVEs). CVSS 9.1 CRITICAL. Priority 15.3 of 100.","summary":"IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:31:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.3,"kev":null,"epss":{"score":0.00382,"percentile":0.32191},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-84209","url":"https://patchfirst.co/cve/CVE-2026-84209/","title":"CVE-2026-84209: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.3% (higher than 25.7% of CVEs). CVSS 9.8 CRITICAL. Priority 14.5 of 100.","summary":"IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-15T00:05:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.5,"kev":null,"epss":{"score":0.00326,"percentile":0.25716},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-14992","url":"https://patchfirst.co/cve/CVE-2026-14992/","title":"CVE-2026-14992: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","content_text":"IBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.3% (higher than 24.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T19:47:01.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00318,"percentile":0.24757},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6CD","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-80381","url":"https://patchfirst.co/cve/CVE-2026-80381/","title":"CVE-2026-80381: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.3% (higher than 23.9% of CVEs). CVSS 9.8 CRITICAL. Priority 14.2 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:34:54.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.2,"kev":null,"epss":{"score":0.0031,"percentile":0.23921},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-81932","url":"https://patchfirst.co/cve/CVE-2026-81932/","title":"CVE-2026-81932: IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.3% (higher than 21.4% of CVEs). CVSS 9.8 CRITICAL. Priority 13.7 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T20:34:43.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.7,"kev":null,"epss":{"score":0.00288,"percentile":0.21353},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-14990","url":"https://patchfirst.co/cve/CVE-2026-14990/","title":"CVE-2026-14990: IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting","content_text":"IBM · DataPower Gateway 10.6.0. Not in CISA KEV. EPSS 0.3% (higher than 23.5% of CVEs). CVSS 9.3 CRITICAL. Priority 13.7 of 100.","summary":"IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-08T20:49:50.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.7,"kev":null,"epss":{"score":0.00307,"percentile":0.23503},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6.0","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-82334","url":"https://patchfirst.co/cve/CVE-2026-82334/","title":"CVE-2026-82334: IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7…","content_text":"IBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.3% (higher than 22.8% of CVEs). CVSS 9.1 CRITICAL. Priority 13.5 of 100.","summary":"IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-10T04:18:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.5,"kev":null,"epss":{"score":0.00301,"percentile":0.22808},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Guardium Data Protection","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-14988","url":"https://patchfirst.co/cve/CVE-2026-14988/","title":"CVE-2026-14988: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","content_text":"IBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.3% (higher than 17.4% of CVEs). CVSS 9.8 CRITICAL. Priority 12.9 of 100.","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-14T19:48:59.000Z","tags":[],"_patchfirst":{"reason":"published","priority":12.9,"kev":null,"epss":{"score":0.00257,"percentile":0.1737},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"DataPower Gateway 10.6CD","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-93674","url":"https://patchfirst.co/cve/CVE-2026-93674/","title":"CVE-2026-93674: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper…","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 15.3% (higher than 96.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 33.4 of 100.","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper…","date_published":"2026-10-07T00:00:00.000Z","date_modified":"2026-10-08T18:29:00.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":33.4,"kev":null,"epss":{"score":0.15286,"percentile":0.96766},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-104334","url":"https://patchfirst.co/cve/CVE-2026-104334/","title":"CVE-2026-104334: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control…","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 0.7% (higher than 53.6% of CVEs). CVSS 9.8 CRITICAL. Priority 19.7 of 100.","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control…","date_published":"2026-10-07T00:00:00.000Z","date_modified":"2026-10-08T18:25:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.7,"kev":null,"epss":{"score":0.00713,"percentile":0.53601},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-93675","url":"https://patchfirst.co/cve/CVE-2026-93675/","title":"CVE-2026-93675: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected…","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 0.6% (higher than 49.9% of CVEs). CVSS 9.8 CRITICAL. Priority 19.0 of 100.","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected…","date_published":"2026-10-07T00:00:00.000Z","date_modified":"2026-10-08T18:25:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19,"kev":null,"epss":{"score":0.00625,"percentile":0.49923},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-9198#kev","url":"https://patchfirst.co/cve/CVE-2026-9198/","title":"[KEV] CVE-2026-9198: IBM Langflow Code Injection Vulnerability","content_text":"IBM · Langflow. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 28.7% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"IBM Langflow Code Injection Vulnerability","date_published":"2026-08-04T00:00:00.000Z","date_modified":"2026-10-24T20:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-08-04","ransomware":false},"epss":{"score":0.28658,"percentile":0.98135},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-7873","url":"https://patchfirst.co/cve/CVE-2026-7873/","title":"CVE-2026-7873: Code Injection Vulnerability in Code Validation Endpoint","content_text":"IBM · Langflow OSS. Not in CISA KEV. EPSS 1.6% (higher than 75.1% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 73.5 of 100.","summary":"Code Injection Vulnerability in Code Validation Endpoint","date_published":"2026-06-30T00:00:00.000Z","date_modified":"2026-07-01T17:27:51.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":73.5,"kev":null,"epss":{"score":0.0155,"percentile":0.75057},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"IBM","product":"Langflow OSS","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}