I (Ibm) - vulnerabilities (CVEs)

191 CVEs, 16 in the last 30 days, 27 known versions, newest CVE from 2026-10-20. Vendor: Ibm.

CVEs of I

• CVE-2026-93744 - CVSS 6.5 (medium), 2026-10-20: IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a…
• CVE-2026-17068 - CVSS 5.4 (medium), 2026-10-16: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
• CVE-2026-17073 - CVSS 5.5 (medium), 2026-10-16: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
• CVE-2026-17275 - CVSS 5.3 (medium), 2026-10-16: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of…
• CVE-2026-17488 - CVSS 6.5 (medium), 2026-10-16: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
• CVE-2026-17491 - CVSS 5.4 (medium), 2026-10-16: IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory…
• CVE-2026-102917 - CVSS 7.8 (high), 2026-10-16: IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform…
• CVE-2026-107674 - CVSS 5.1 (medium), 2026-10-16: IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create…
• CVE-2026-17484 - CVSS 5.5 (medium), 2026-10-12: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.
• CVE-2026-17487 - CVSS 5.3 (medium), 2026-10-12: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
• CVE-2026-18318 - CVSS 5.3 (medium), 2026-10-12: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.
• CVE-2026-18343 - CVSS 4.4 (medium), 2026-10-12: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.
• CVE-2026-81858 - CVSS 8.1 (high), 2026-10-12: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in…
• CVE-2026-93886 - CVSS 8.3 (high), 2026-10-12: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
• CVE-2026-96119 - CVSS 9.9 (critical), 2026-10-12: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to…
• CVE-2026-84414 - CVSS 7.8 (high), 2026-09-29: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an…
• CVE-2026-18869 - CVSS 6.4 (medium), 2026-09-18: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper…
• CVE-2026-17262 - CVSS 5.4 (medium), 2026-09-18: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.
• CVE-2026-18069 - CVSS 6 (medium), 2026-09-14: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU)…
• CVE-2026-19086 - CVSS 3.3 (low), 2026-09-14: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this…
• CVE-2026-19280 - CVSS 5.2 (medium), 2026-09-14: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this…
• CVE-2026-18065 - CVSS 5.3 (medium), 2026-09-14: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in…
• CVE-2026-18251 - CVSS 4.3 (medium), 2026-09-14: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.
• CVE-2026-18151 - CVSS 4.2 (medium), 2026-09-14: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket…
• CVE-2026-18515 - CVSS 4.3 (medium), 2026-09-14: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked…
• CVE-2026-16693 - CVSS 4.9 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants…
• CVE-2026-16826 - CVSS 7.8 (high), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS…
• CVE-2026-16892 - CVSS 5.4 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name…
• CVE-2026-16941 - CVSS 4.3 (medium), 2026-09-04: IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization.
• CVE-2026-17057 - CVSS 9.1 (critical), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical…
• CVE-2026-17207 - CVSS 9.1 (critical), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow.
• CVE-2026-17255 - CVSS 7.5 (high), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of the prefix length in ICMPv6 Router…
• CVE-2026-17259 - CVSS 6.5 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.
• CVE-2026-17270 - CVSS 5.5 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.
• CVE-2026-17273 - CVSS 6.5 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.
• CVE-2026-17274 - CVSS 5.4 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds.
• CVE-2026-17469 - CVSS 5.5 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.
• CVE-2026-17470 - CVSS 7.5 (high), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.
• CVE-2026-17499 - CVSS 7.8 (high), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS…
• CVE-2026-18073 - CVSS 4.4 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special…
• CVE-2026-18078 - CVSS 6.5 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow.
• CVE-2026-18076 - CVSS 6.5 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.
• CVE-2026-18175 - CVSS 8.1 (high), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.
• CVE-2026-18221 - CVSS 9.8 (critical), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
• CVE-2026-18341 - CVSS 8.8 (high), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow.
• CVE-2026-18858 - CVSS 5.5 (medium), 2026-09-04: IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.
• CVE-2026-18887 - CVSS 6.5 (medium), 2026-09-04: IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to…
• CVE-2026-17015 - CVSS 8.1 (high), 2026-08-19: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds…
• CVE-2026-18102 - CVSS 4.3 (medium), 2026-08-19: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking.
• CVE-2026-18715 - CVSS 6.5 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.
• CVE-2026-18671 - CVSS 6.5 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds…
• CVE-2026-18511 - CVSS 7.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by…
• CVE-2026-18509 - CVSS 8.2 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the…
• CVE-2026-18249 - CVSS 9.9 (critical), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from…
• CVE-2026-18193 - CVSS 10 (critical), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses.
• CVE-2026-18101 - CVSS 8.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.
• CVE-2026-18086 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking.
• CVE-2026-18077 - CVSS 7.5 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.
• CVE-2026-18068 - CVSS 4.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion.
• CVE-2026-18020 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.
• CVE-2026-17649 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
• CVE-2026-17502 - CVSS 8.6 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
• CVE-2026-17476 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.
• CVE-2026-17438 - CVSS 4.4 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.
• CVE-2026-17075 - CVSS 8.2 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of…
• CVE-2026-17272 - CVSS 8.2 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.
• CVE-2026-17226 - CVSS 5.4 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds…
• CVE-2026-17216 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers.
• CVE-2026-17212 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
• CVE-2026-17101 - CVSS 9.6 (critical), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
• CVE-2026-17099 - CVSS 7.3 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
• CVE-2026-17088 - CVSS 4.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
• CVE-2026-17078 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
• CVE-2026-17077 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.
• CVE-2026-17076 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM resynchronization requests.
• CVE-2026-17074 - CVSS 4.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management.
• CVE-2026-17071 - CVSS 2.7 (low), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal.
• CVE-2026-17069 - CVSS 8.1 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens.
• CVE-2026-17045 - CVSS 8.1 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper…
• CVE-2026-17043 - CVSS 3.8 (low), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
• CVE-2026-17029 - CVSS 8.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write.
• CVE-2026-16987 - CVSS 8.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.
• CVE-2026-16975 - CVSS 8.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.
• CVE-2026-16967 - CVSS 8.5 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use…
• CVE-2026-16961 - CVSS 9.8 (critical), 2026-08-13: IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view,…
• CVE-2026-16908 - CVSS 8.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.
• CVE-2026-16898 - CVSS 7.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an…
• CVE-2026-16896 - CVSS 7.1 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use (TOCTOU)…
• CVE-2026-16887 - CVSS 7.5 (high), 2026-08-13: IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
• CVE-2026-16878 - CVSS 6.5 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
• CVE-2026-16871 - CVSS 4.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow.
• CVE-2026-16868 - CVSS 8.1 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.
• CVE-2026-16867 - CVSS 9.8 (critical), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper…
• CVE-2026-16861 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
• CVE-2026-16859 - CVSS 5.3 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
• CVE-2026-16853 - CVSS 7.5 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
• CVE-2026-16815 - CVSS 9.1 (critical), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based…
• CVE-2026-16722 - CVSS 8.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.
• CVE-2026-16692 - CVSS 6.5 (medium), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.
• CVE-2026-16674 - CVSS 8.8 (high), 2026-08-13: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.