Security Vulnerabilities
IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions.
CVSS Score
6.5
EPSS Score
0.005
Published
2026-11-08
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
CVSS Score
5.5
EPSS Score
0.002
Published
2026-11-08
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-11-08
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.
CVSS Score
2.5
EPSS Score
0.001
Published
2026-11-08
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.
CVSS Score
4.2
EPSS Score
0.002
Published
2026-11-08
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
CVSS Score
5.4
EPSS Score
0.002
Published
2026-11-08
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.
CVSS Score
4.4
EPSS Score
0.002
Published
2026-11-08
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-11-08
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-11-08
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently restricted, which could allow the server to contact internal systems.
CVSS Score
6.4
EPSS Score
0.003
Published
2026-11-07