Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78575 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation o... | 2026-09-16 |
| CVE-2026-78573 | critical | 9.8 | No | IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default crede... | 2026-09-16 |
| CVE-2026-78571 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call... | 2026-09-16 |
| CVE-2026-78569 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the s... | 2026-09-16 |
| CVE-2026-76059 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by... | 2026-09-16 |
| CVE-2026-80436 | high | 8.5 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary R... | 2026-09-16 |
| CVE-2026-80434 | medium | 5.0 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of s... | 2026-09-16 |
| CVE-2026-80424 | critical | 9.1 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal duri... | 2026-09-16 |
| CVE-2026-80380 | high | 7.1 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery. | 2026-09-16 |
| CVE-2026-80378 | medium | 6.5 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authori... | 2026-09-16 |
| CVE-2026-81210 | high | 7.7 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage R... | 2026-09-16 |
| CVE-2026-81207 | high | 8.5 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/hos... | 2026-09-16 |
| CVE-2026-81540 | high | 8.5 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenant... | 2026-09-16 |
| CVE-2026-81550 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutraliza... | 2026-09-16 |
| CVE-2026-81554 | medium | 6.5 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-p... | 2026-09-16 |
| CVE-2026-81551 | high | 8.1 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared st... | 2026-09-16 |
| CVE-2026-82092 | medium | 6.5 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-p... | 2026-09-16 |
| CVE-2026-82095 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutraliza... | 2026-09-16 |
| CVE-2026-82097 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Reque... | 2026-09-16 |
| CVE-2026-82098 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutra... | 2026-09-16 |