TIBCO vulnerabilities
We track 23 vulnerabilities in TIBCO products across 27 products. 22 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on November 12, 2026.
Latest TIBCO vulnerabilities
- 8.8 High severity
TIBCO Platform’s Self-Hosted Control Plane: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane. This issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.
- 8.7 High severity
Administrator: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console.
- 8.7 High severity
Injection vulnerabilities due to validation/sanitisation of user-supplied input in…
Injection vulnerabilities due to validation/sanitisation of user-supplied input in ActiveMatrix BusinessWorks and Enterprise Administrator allows information disclosure, including exposure of accessible local files and host system details, and may allow manipu
- 9.8 Critical severity
Spotfire Statistics Services: Improper Control of Generation of Code
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious f
- 9.9 Critical severity
Spotfire Analyst: Execution with Unnecessary Privileges
Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary co
- 8.3 High severity
JasperReports Server: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting in UI Request/Response Validation in TIBCO JasperReports Server 8.0.4 and 8.2.0 allows allows for the injection of malicious executable scripts into the code of a trusted application that may lead to stealing the user's active session cook
- 8.8 High severity
TIBCO FTL - Enterprise Edition: Improper Privilege Management
The FTL Server component of TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition contains a vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Softwar
- 8.8 High severity
TIBCO Hawk: Use of Hard-coded Credentials
The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, and TIBCO Runtime Agent contain a vulnerability that theoretically allows an attacker
- 9.0 Critical severity
TIBCO Nimbus: Improper Neutralization of Input During Web Page Generation
The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts tar
- 8.8 High severity
TIBCO EBX Add-ons: Improper Neutralization of Special Elements used in an SQL Command
The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the
- 7.2 High severity
TIBCO EBX Add-ons: Improper Limitation of a Pathname to a Restricted Directory
The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4
- 9.8 Critical severity
TIBCO Spotfire Statistics Services: Unrestricted Upload of File with Dangerous Type
The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected
- 8.4 High severity
TIBCO JasperReports Server: Improper Neutralization of Input During Web Page Generation
The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO J
- 9.3 Critical severity
TIBCO Nimbus: URL Redirection to Untrusted Site
The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to exploit an open redirect on the affected system. A successful attack using this vulnerabi
- 9.0 Critical severity
TIBCO EBX Add-ons: Improper Neutralization of Input During Web Page Generation
The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack
- 9.0 Critical severity
TIBCO EBX: Improper Neutralization of Input During Web Page Generation
The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using th
- 8.4 High severity
TIBCO Spotfire Analytics Platform for AWS…: Server-Side Request Forgery
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Si
- 8.8 High severity
TIBCO BusinessConnect Trading Community…: Cross-Site Request Forgery
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute Cross-Site Request Forgery (CSRF) on the af
- 9.1 Critical severity
TIBCO Managed File Transfer Command Center: Improper Restriction of XML External Entity Reference
The DOM XML parser and SAX XML parser components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, and TIBCO Managed File Transfer Internet Server conta
- 8.8 High severity
TIBCO JasperReports Library: Improper Limitation of a Pathname to a Restricted Directory
The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO
- 9.0 Critical severity
TIBCO EBX: Improper Neutralization of Input During Web Page Generation
The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a lo
- 6.5 Medium severity
TIBCO JasperReports Library Directory Traversal Exploited
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, T
- 8.8 High severity
TIBCO JasperReports Server Information Disclosure Exploited
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics f