Patchfirst: IBM vulnerabilitieshttps://patchfirst.co/vendor/ibm/New and newly exploited IBM CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-93680: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…https://patchfirst.co/cve/CVE-2026-93680/CVE-2026-93680Thu, 29 Oct 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 2.3% (higher than 83% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 29.1 of 100.public-exploitCVE-2026-104339: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…https://patchfirst.co/cve/CVE-2026-104339/CVE-2026-104339Thu, 29 Oct 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 0.7% (higher than 54.8% of CVEs). CVSS 9.8 CRITICAL. Priority 18.5 of 100.CVE-2026-110186: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control…https://patchfirst.co/cve/CVE-2026-110186/CVE-2026-110186Thu, 29 Oct 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 9.8 CRITICAL. Priority 17.5 of 100.CVE-2026-104317: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute…https://patchfirst.co/cve/CVE-2026-104317/CVE-2026-104317Thu, 29 Oct 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 0.6% (higher than 47.4% of CVEs). CVSS 9.8 CRITICAL. Priority 17.0 of 100.CVE-2026-18894: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…https://patchfirst.co/cve/CVE-2026-18894/CVE-2026-18894Thu, 29 Oct 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 0.4% (higher than 37% of CVEs). CVSS 9.8 CRITICAL. Priority 14.9 of 100.CVE-2026-92559: IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due…https://patchfirst.co/cve/CVE-2026-92559/CVE-2026-92559Tue, 20 Oct 2026 00:00:00 GMTIBM · App Connect Enterprise. Not in CISA KEV. EPSS 0.5% (higher than 44.8% of CVEs). CVSS 9.8 CRITICAL. Priority 17.7 of 100.CVE-2026-81212: IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared…https://patchfirst.co/cve/CVE-2026-81212/CVE-2026-81212Tue, 20 Oct 2026 00:00:00 GMTIBM · DataStage on Cloud Pak for Data. Not in CISA KEV. EPSS 0.3% (higher than 18.8% of CVEs). CVSS 10.0 CRITICAL. Priority 12.7 of 100.CVE-2026-12665: IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS…https://patchfirst.co/cve/CVE-2026-12665/CVE-2026-12665Mon, 19 Oct 2026 00:00:00 GMTIBM · MQ Operator. Not in CISA KEV. EPSS 0.3% (higher than 24.5% of CVEs). CVSS 9.8 CRITICAL. Priority 13.5 of 100.CVE-2026-53709: MCP Context Forge is an MCP gateway and administrative platformhttps://patchfirst.co/cve/CVE-2026-53709/CVE-2026-53709Tue, 13 Oct 2026 00:00:00 GMTIBM · mcp-context-forge. Not in CISA KEV. EPSS 0.6% (higher than 48.8% of CVEs). CVSS 9.8 CRITICAL. Priority 18.8 of 100.CVE-2026-96119: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute…https://patchfirst.co/cve/CVE-2026-96119/CVE-2026-96119Tue, 13 Oct 2026 00:00:00 GMTIBM · i. Not in CISA KEV. EPSS 0.5% (higher than 44.1% of CVEs). CVSS 9.9 CRITICAL. Priority 17.9 of 100.CVE-2026-93895: IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker…https://patchfirst.co/cve/CVE-2026-93895/CVE-2026-93895Tue, 13 Oct 2026 00:00:00 GMTIBM · WebSphere Application Server - Liberty. Not in CISA KEV. EPSS 0.4% (higher than 33.6% of CVEs). CVSS 9.1 CRITICAL. Priority 15.3 of 100.CVE-2026-93909: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass…https://patchfirst.co/cve/CVE-2026-93909/CVE-2026-93909Tue, 13 Oct 2026 00:00:00 GMTIBM · WebSphere Application Server - Liberty. Not in CISA KEV. EPSS 0.3% (higher than 27.1% of CVEs). CVSS 9.1 CRITICAL. Priority 13.9 of 100.CVE-2026-95695: IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass…https://patchfirst.co/cve/CVE-2026-95695/CVE-2026-95695Tue, 13 Oct 2026 00:00:00 GMTIBM · WebSphere Application Server - Liberty. Not in CISA KEV. EPSS 0.3% (higher than 25.4% of CVEs). CVSS 9.1 CRITICAL. Priority 13.6 of 100.CVE-2026-90920: IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control…https://patchfirst.co/cve/CVE-2026-90920/CVE-2026-90920Mon, 12 Oct 2026 00:00:00 GMTIBM · Maximo AI Service. Not in CISA KEV. EPSS 0.5% (higher than 45.6% of CVEs). CVSS 9.8 CRITICAL. Priority 18.2 of 100.CVE-2026-82110: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due…https://patchfirst.co/cve/CVE-2026-82110/CVE-2026-82110Mon, 12 Oct 2026 00:00:00 GMTIBM · DataStage on Cloud Pak for Data. Not in CISA KEV. EPSS 0.5% (higher than 43.9% of CVEs). CVSS 9.9 CRITICAL. Priority 17.9 of 100.CVE-2026-82101: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service…https://patchfirst.co/cve/CVE-2026-82101/CVE-2026-82101Mon, 12 Oct 2026 00:00:00 GMTIBM · DataStage on Cloud Pak for Data. Not in CISA KEV. EPSS 0.4% (higher than 35.9% of CVEs). CVSS 9.6 CRITICAL. Priority 16.1 of 100.CVE-2026-19622: IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due…https://patchfirst.co/cve/CVE-2026-19622/CVE-2026-19622Mon, 12 Oct 2026 00:00:00 GMTIBM · Planning Analytics. Not in CISA KEV. EPSS 0.3% (higher than 28.6% of CVEs). CVSS 9.8 CRITICAL. Priority 14.7 of 100.CVE-2026-96012: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalationhttps://patchfirst.co/cve/CVE-2026-96012/CVE-2026-96012Mon, 12 Oct 2026 00:00:00 GMTIBM · Db2 Mirror for i. Not in CISA KEV. EPSS 0.3% (higher than 24.2% of CVEs). CVSS 9.9 CRITICAL. Priority 13.9 of 100.CVE-2026-78401: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a…https://patchfirst.co/cve/CVE-2026-78401/CVE-2026-78401Thu, 08 Oct 2026 00:00:00 GMTIBM · Security Verify Access. Not in CISA KEV. EPSS 0.8% (higher than 55.9% of CVEs). CVSS 9.8 CRITICAL. Priority 20.6 of 100.CVE-2026-78406: IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a…https://patchfirst.co/cve/CVE-2026-78406/CVE-2026-78406Thu, 08 Oct 2026 00:00:00 GMTIBM · Security Verify Access. Not in CISA KEV. EPSS 0.8% (higher than 55% of CVEs). CVSS 9.8 CRITICAL. Priority 20.4 of 100.CVE-2026-75875: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path…https://patchfirst.co/cve/CVE-2026-75875/CVE-2026-75875Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.6% (higher than 48.3% of CVEs). CVSS 9.8 CRITICAL. Priority 19.0 of 100.CVE-2026-15762: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…https://patchfirst.co/cve/CVE-2026-15762/CVE-2026-15762Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.5% (higher than 44.6% of CVEs). CVSS 9.8 CRITICAL. Priority 18.3 of 100.CVE-2026-16340: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…https://patchfirst.co/cve/CVE-2026-16340/CVE-2026-16340Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.5% (higher than 42% of CVEs). CVSS 9.8 CRITICAL. Priority 17.8 of 100.CVE-2026-14269: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…https://patchfirst.co/cve/CVE-2026-14269/CVE-2026-14269Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.5% (higher than 41.8% of CVEs). CVSS 9.8 CRITICAL. Priority 17.7 of 100.CVE-2026-84249: IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations…https://patchfirst.co/cve/CVE-2026-84249/CVE-2026-84249Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 36.3% of CVEs). CVSS 9.8 CRITICAL. Priority 16.6 of 100.CVE-2026-14991: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…https://patchfirst.co/cve/CVE-2026-14991/CVE-2026-14991Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.4% (higher than 36.1% of CVEs). CVSS 9.8 CRITICAL. Priority 16.6 of 100.CVE-2026-84272: IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller componenthttps://patchfirst.co/cve/CVE-2026-84272/CVE-2026-84272Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 34.4% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.CVE-2026-82344: IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS…https://patchfirst.co/cve/CVE-2026-82344/CVE-2026-82344Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 34.7% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.CVE-2026-14502: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…https://patchfirst.co/cve/CVE-2026-14502/CVE-2026-14502Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.4% (higher than 33.9% of CVEs). CVSS 9.8 CRITICAL. Priority 16.2 of 100.CVE-2026-84057: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to…https://patchfirst.co/cve/CVE-2026-84057/CVE-2026-84057Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.8% of CVEs). CVSS 9.8 CRITICAL. Priority 15.9 of 100.CVE-2026-84246: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…https://patchfirst.co/cve/CVE-2026-84246/CVE-2026-84246Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-84198: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…https://patchfirst.co/cve/CVE-2026-84198/CVE-2026-84198Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-84035: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…https://patchfirst.co/cve/CVE-2026-84035/CVE-2026-84035Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-82895: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a…https://patchfirst.co/cve/CVE-2026-82895/CVE-2026-82895Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-82335: IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol…https://patchfirst.co/cve/CVE-2026-82335/CVE-2026-82335Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-14888: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…https://patchfirst.co/cve/CVE-2026-14888/CVE-2026-14888Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.4% (higher than 32.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-84058: IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server)…https://patchfirst.co/cve/CVE-2026-84058/CVE-2026-84058Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 31.8% of CVEs). CVSS 9.8 CRITICAL. Priority 15.7 of 100.CVE-2026-82900: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper…https://patchfirst.co/cve/CVE-2026-82900/CVE-2026-82900Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.4% (higher than 32.2% of CVEs). CVSS 9.1 CRITICAL. Priority 15.3 of 100.CVE-2026-84209: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to…https://patchfirst.co/cve/CVE-2026-84209/CVE-2026-84209Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.3% (higher than 25.7% of CVEs). CVSS 9.8 CRITICAL. Priority 14.5 of 100.CVE-2026-14992: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…https://patchfirst.co/cve/CVE-2026-14992/CVE-2026-14992Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.3% (higher than 24.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-80381: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements…https://patchfirst.co/cve/CVE-2026-80381/CVE-2026-80381Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.3% (higher than 23.9% of CVEs). CVSS 9.8 CRITICAL. Priority 14.2 of 100.CVE-2026-81932: IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injectionhttps://patchfirst.co/cve/CVE-2026-81932/CVE-2026-81932Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.3% (higher than 21.4% of CVEs). CVSS 9.8 CRITICAL. Priority 13.7 of 100.CVE-2026-14990: IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scriptinghttps://patchfirst.co/cve/CVE-2026-14990/CVE-2026-14990Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6.0. Not in CISA KEV. EPSS 0.3% (higher than 23.5% of CVEs). CVSS 9.3 CRITICAL. Priority 13.7 of 100.CVE-2026-82334: IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7…https://patchfirst.co/cve/CVE-2026-82334/CVE-2026-82334Thu, 08 Oct 2026 00:00:00 GMTIBM · Guardium Data Protection. Not in CISA KEV. EPSS 0.3% (higher than 22.8% of CVEs). CVSS 9.1 CRITICAL. Priority 13.5 of 100.CVE-2026-14988: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0…https://patchfirst.co/cve/CVE-2026-14988/CVE-2026-14988Thu, 08 Oct 2026 00:00:00 GMTIBM · DataPower Gateway 10.6CD. Not in CISA KEV. EPSS 0.3% (higher than 17.4% of CVEs). CVSS 9.8 CRITICAL. Priority 12.9 of 100.CVE-2026-93674: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper…https://patchfirst.co/cve/CVE-2026-93674/CVE-2026-93674Wed, 07 Oct 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 15.3% (higher than 96.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 33.4 of 100.public-exploitCVE-2026-104334: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control…https://patchfirst.co/cve/CVE-2026-104334/CVE-2026-104334Wed, 07 Oct 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 0.7% (higher than 53.6% of CVEs). CVSS 9.8 CRITICAL. Priority 19.7 of 100.CVE-2026-93675: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected…https://patchfirst.co/cve/CVE-2026-93675/CVE-2026-93675Wed, 07 Oct 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 0.6% (higher than 49.9% of CVEs). CVSS 9.8 CRITICAL. Priority 19.0 of 100.[KEV] CVE-2026-9198: IBM Langflow Code Injection Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-9198/CVE-2026-9198#kevTue, 04 Aug 2026 00:00:00 GMTIBM · Langflow. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 28.7% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.kevpublic-exploitT1190T1059CVE-2026-7873: Code Injection Vulnerability in Code Validation Endpointhttps://patchfirst.co/cve/CVE-2026-7873/CVE-2026-7873Tue, 30 Jun 2026 00:00:00 GMTIBM · Langflow OSS. Not in CISA KEV. EPSS 1.6% (higher than 75.1% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 73.5 of 100.public-exploit