IBM vulnerabilities
We track 1,482 vulnerabilities in IBM products across 60+ products. 1,480 are rated high or critical, and 12 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest IBM vulnerabilities
- 8.8 High severity
Financial Transaction Manager (FTM) for RedHat…: Out-of-bounds Write
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
- 7.5 High severity
Financial Transaction Manager (FTM) for RedHat…: Improper Authentication
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization.
- 7.1 High severity
Financial Transaction Manager (FTM) for RedHat…: Server-Side Request Forgery
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.
- 8.8 High severity
Financial Transaction Manager (FTM) for RedHat…: Inclusion of Functionality from Untrusted Control Sphere
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.
- 8.8 High severity
Financial Transaction Manager (FTM) for RedHat…: Improper Privilege Management
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.
- 7.1 High severity
Financial Transaction Manager (FTM) for RedHat…: Use of Hard-coded Credentials
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.
- 7.1 High severity
Financial Transaction Manager (FTM) for RedHat…: Insufficiently Protected Credentials
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.
- 8.8 High severity
Financial Transaction Manager (FTM) for RedHat…: Deserialization of Untrusted Data
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.
- 8.8 High severity
Financial Transaction Manager (FTM) for RedHat…: Out-of-bounds Write
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.
- 9.1 Critical severity
Financial Transaction Manager (FTM) for RedHat…: Missing Authentication for Critical Functionality
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.
- 7.5 High severity
Financial Transaction Manager (FTM) for RedHat…: Unprotected Transport of Credentials
IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 IBM Financial Transaction Manager transmits sensitive or security-critical data in
- 9.8 Critical severity
Financial Transaction Manager (FTM) for RedHat…: Missing Authorization
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.
- 9.6 Critical severity
Concert: Improper Privilege Management
IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 9.9 Critical severity
DataStage on Cloud Pak for Data: Improper Authorization
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 7.5 High severity
Concert: Use of a Broken or Risky Cryptographic Algorithm
IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- 7.6 High severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an SQL Command
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
- 8.1 High severity
Guardium Data Protection: Improper Neutralization of Input During Web Page Generation
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation.
- 8.9 High severity
Guardium Data Protection: Improper Neutralization of Input During Web Page Generation
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.
- 7.7 High severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an SQL Command
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
- 7.2 High severity
Guardium Data Protection: Improper Limitation of a Pathname to a Restricted Directory
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.
- 8.1 High severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an OS Command
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
Guardium Data Protection: Cross-Site Request Forgery
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery (CSRF) vulnerability.
- 7.8 High severity
Guardium Data Protection: Improper Privilege Management
IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUI
- 9.8 Critical severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an SQL Command
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
- 9.9 Critical severity
Guardium Data Protection: Missing Authentication for Critical Functionality
IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-balancer operations, potentially resulting in unauthorized actions and impact to the integr
- 9.9 Critical severity
Guardium Data Protection: Missing Authentication for Critical Functionality
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet.
- 8.9 High severity
Guardium Data Protection: Improper Neutralization of Input During Web Page Generation
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.
- 9.1 Critical severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an SQL Command
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
- 7.2 High severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an OS Command
IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the appli
- 8.9 High severity
Guardium Data Protection: Improper Neutralization of Input During Web Page Generation
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.
- 9.9 Critical severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an SQL Command
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
- 8.8 High severity
Guardium Data Protection: Use of Hard-coded Credentials
IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthorized access to
- 9.0 Critical severity
Guardium Data Protection: Improper Neutralization of Input During Web Page Generation
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.
- 9.8 Critical severity
Guardium Data Protection: Missing Authentication for Critical Functionality
IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface.
- 7.6 High severity
Guardium Data Protection: Improper Limitation of a Pathname to a Restricted Directory
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability.
- 8.1 High severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an OS Command
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
Guardium Data Protection: Improper Neutralization of Special Elements used in an OS Command
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.