Every CVE whose affected-product data names Ibm I, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (169)
CVE-2026-16860 — CVSS 9.9 (critical): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path…
CVE-2026-17083 — CVSS 9.8 (critical): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17218 — CVSS 9.8 (critical): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
CVE-2026-17276 — CVSS 9.6 (critical): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the…
CVE-2026-18193 — CVSS 8.9 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled…
CVE-2026-18099 — CVSS 8.9 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of…
CVE-2026-16722 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege…
CVE-2025-36367 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A…
CVE-2025-36004 — CVSS 8.8 (high): IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for…
CVE-2026-18101 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.
CVE-2026-17642 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of…
CVE-2022-22495 — CVSS 8.8 (high): IBM i 7.3, 7.4, and 7.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow…
CVE-2026-17082 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a…
CVE-2026-17029 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write.
CVE-2026-16987 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment…
CVE-2026-16975 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.
CVE-2026-18713 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a…
CVE-2026-18683 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a…
CVE-2026-18669 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the…
CVE-2026-16906 — CVSS 8.8 (high): IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper…
CVE-2026-16856 — CVSS 8.8 (high): IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an…
CVE-2026-16674 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.
CVE-2026-17417 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of…
CVE-2026-17223 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-17110 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due…
CVE-2026-7870 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could…
CVE-2026-18847 — CVSS 8.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i.
CVE-2026-16815 — CVSS 8.6 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to…
CVE-2023-30990 — CVSS 8.6 (high): IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture…
CVE-2026-17502 — CVSS 8.6 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
CVE-2024-55898 — CVSS 8.5 (high): IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an…
CVE-2026-16967 — CVSS 8.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a…
CVE-2026-16908 — CVSS 8.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path…
CVE-2026-17418 — CVSS 8.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of…
CVE-2013-5385 — CVSS 8.5 (high): The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System (aka NOS, formerly BLADE…
CVE-2025-33103 — CVSS 8.5 (high): IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 product IBM TCP/IP Connectivity Utilities for i contains a privilege escalation vulnerability. A…
CVE-2025-33108 — CVSS 8.5 (high): IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain…
CVE-2023-38721 — CVSS 8.4 (high): The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor…
CVE-2023-30988 — CVSS 8.4 (high): The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor…
CVE-2023-30989 — CVSS 8.4 (high): IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with command line…
CVE-2023-42006 — CVSS 8.4 (high): IBM Administration Runtime Expert for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information caused by improper…
CVE-2024-22346 — CVSS 8.4 (high): Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library…
CVE-2024-25050 — CVSS 8.4 (high): IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio for i 7.2, 7.3, 7.4, 7.5 networking and compiler infrastructure could allow a…
CVE-2026-18249 — CVSS 8.4 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers…
CVE-2026-18235 — CVSS 8.3 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient…
CVE-2026-17101 — CVSS 8.3 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper…
CVE-2026-17095 — CVSS 8.3 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection.
CVE-2026-17272 — CVSS 8.2 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.
CVE-2026-18509 — CVSS 8.2 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This…
CVE-2026-17445 — CVSS 8.2 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an…
CVE-2026-17485 — CVSS 8.2 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer…
CVE-2021-20501 — CVSS 8.2 (high): IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server…
CVE-2026-17220 — CVSS 8.2 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer…
CVE-2026-17197 — CVSS 8.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted…
CVE-2026-9072 — CVSS 8.1 (high): IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere…
CVE-2026-18098 — CVSS 8.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity…
CVE-2026-16867 — CVSS 8.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to…
CVE-2026-16868 — CVSS 8.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1…
CVE-2026-16904 — CVSS 8.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management…
CVE-2026-17045 — CVSS 8.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive…
CVE-2026-17069 — CVSS 8.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of…
CVE-2026-17206 — CVSS 8.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2024-31890 — CVSS 7.8 (high): IBM i 7.3, 7.4, and 7.5 product IBM TCP/IP Connectivity Utilities for i contains a local privilege escalation vulnerability. A malicious…
CVE-2026-18071 — CVSS 7.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.
CVE-2026-16898 — CVSS 7.8 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper…
CVE-2026-16863 — CVSS 7.7 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
CVE-2026-16907 — CVSS 7.6 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.
CVE-2026-16961 — CVSS 7.6 (high): IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the…
CVE-2026-17111 — CVSS 7.6 (high): IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could…
CVE-2024-31879 — CVSS 7.5 (high): IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the…
CVE-2025-33109 — CVSS 7.5 (high): IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to a privilege escalation caused by an invalid database authority check. A bad actor could…
CVE-2017-1460 — CVSS 7.5 (high): IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue router spoofs its origin. Routing tables are affected by a missing LSA, which…
CVE-2026-18846 — CVSS 7.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one…
CVE-2026-18077 — CVSS 7.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.
CVE-2026-17199 — CVSS 7.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation.
CVE-2026-16887 — CVSS 7.5 (high): IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
CVE-2026-17271 — CVSS 7.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.
CVE-2026-16931 — CVSS 7.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.
CVE-2026-16982 — CVSS 7.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
CVE-2026-17004 — CVSS 7.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.
CVE-2026-8858 — CVSS 7.5 (high): IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service…
CVE-2026-17229 — CVSS 7.5 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.
CVE-2026-1376 — CVSS 7.5 (high): IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to improper allocation of…
CVE-2025-33122 — CVSS 7.5 (high): IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job…
CVE-2024-27275 — CVSS 7.4 (high): IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local…
CVE-2023-40375 — CVSS 7.4 (high): Integrated application server for IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with…
CVE-2024-27264 — CVSS 7.4 (high): IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call…
CVE-2023-40685 — CVSS 7.4 (high): Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor…
CVE-2026-18511 — CVSS 7.3 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE…
CVE-2026-17099 — CVSS 7.3 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
CVE-2025-2947 — CVSS 7.2 (high): IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the…
CVE-2026-16896 — CVSS 7.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check…
CVE-2025-36119 — CVSS 7.1 (high): IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i…
CVE-2026-17248 — CVSS 7.1 (high): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of…
CVE-2024-38330 — CVSS 7.0 (high): IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program…
CVE-2023-43064 — CVSS 7.0 (high): Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call…
CVE-2026-17268 — CVSS 6.8 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a…
CVE-2024-47104 — CVSS 6.8 (medium): IBM i 7.4 and 7.5 is vulnerable to an authenticated user gaining elevated privilege to a physical file. A user with authority to a view can…
CVE-2026-17266 — CVSS 6.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a…
CVE-2025-36371 — CVSS 6.5 (medium): IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. A user…
CVE-2026-16692 — CVSS 6.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.
CVE-2026-16853 — CVSS 6.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
CVE-2026-17075 — CVSS 6.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to…
CVE-2026-17419 — CVSS 6.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special…
CVE-2021-39056 — CVSS 6.5 (medium): The IBM i 7.1, 7.2, 7.3, and 7.4 Extended Dynamic Remote SQL server (EDRSQL) could allow a remote authenticated user to send a specially…
CVE-2026-18671 — CVSS 6.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer…
CVE-2026-18715 — CVSS 6.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML…
CVE-2026-6936 — CVSS 6.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a denial-of-service attack due to uncontrolled recursion in the Integrated Language…
CVE-2024-52895 — CVSS 6.5 (medium): IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A…
CVE-2026-16694 — CVSS 6.4 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed…
CVE-2026-2311 — CVSS 6.4 (medium): IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization…
CVE-2023-23470 — CVSS 6.4 (medium): IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default…
CVE-2026-17420 — CVSS 6.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of…
CVE-2022-43859 — CVSS 6.3 (medium): IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized…
CVE-2019-4536 — CVSS 6.3 (medium): IBM i 7.4 users who have done a Restore User Profile (RSTUSRPRF) on a system which has been configured with Db2 Mirror for i might have…
CVE-2026-18250 — CVSS 6.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions…
CVE-2019-4450 — CVSS 6.1 (medium): IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2019-4040 — CVSS 6.1 (medium): IBM I 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2021-38876 — CVSS 6.1 (medium): IBM i 7.2, 7.3, and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the…
CVE-2026-10852 — CVSS 5.9 (medium): IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere…
CVE-2026-4942 — CVSS 5.9 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer…
CVE-2019-4381 — CVSS 5.5 (medium): IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced node failure detection…
CVE-2025-3218 — CVSS 5.4 (medium): IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to authentication and authorization attacks due to incorrect validation processing in IBM i…
CVE-2022-34358 — CVSS 5.4 (medium): IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2026-17226 — CVSS 5.4 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due…
CVE-2024-55896 — CVSS 5.4 (medium): IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could…
CVE-2025-2950 — CVSS 5.4 (medium): IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by…
CVE-2026-16878 — CVSS 5.4 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
CVE-2024-51463 — CVSS 5.4 (medium): IBM i 7.3, 7.4, and 7.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized…
CVE-2026-17077 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.
CVE-2026-17076 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM…
CVE-2026-17212 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
CVE-2026-17216 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA…
CVE-2026-16929 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.
CVE-2023-47741 — CVSS 5.3 (medium): IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be…
CVE-2022-22481 — CVSS 5.3 (medium): IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid…
CVE-2026-17649 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
CVE-2026-18020 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.
CVE-2026-16861 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
CVE-2026-16859 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
CVE-2024-31878 — CVSS 5.3 (medium): IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can…
CVE-2026-17078 — CVSS 5.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
CVE-2023-40377 — CVSS 4.9 (medium): Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious…
CVE-2023-40378 — CVSS 4.9 (medium): IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host…
CVE-2023-40686 — CVSS 4.9 (medium): Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor…
CVE-2026-17476 — CVSS 4.8 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.
CVE-2026-18086 — CVSS 4.5 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds…
CVE-2026-17438 — CVSS 4.4 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege…
CVE-2022-43857 — CVSS 4.3 (medium): IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but…
CVE-2022-43858 — CVSS 4.3 (medium): IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to…
CVE-2026-16871 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow.
CVE-2026-18106 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of…
CVE-2026-18144 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.
CVE-2026-18148 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to…
CVE-2026-18150 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.
CVE-2024-51464 — CVSS 4.3 (medium): IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an…
CVE-2026-17222 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper…
CVE-2022-43860 — CVSS 4.3 (medium): IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not…
CVE-2026-17094 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path…
CVE-2026-17088 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal…
CVE-2026-18068 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion.
CVE-2026-17109 — CVSS 4.3 (medium): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter…
CVE-2026-17043 — CVSS 3.8 (low): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
CVE-2020-4345 — CVSS 3.3 (low): IBM i 7.2, 7.3, and 7.4 users running complex SQL statements under a specific set of circumstances may allow a local user to obtain…
CVE-2024-31870 — CVSS 3.3 (low): IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated…
CVE-2026-17074 — CVSS 3.1 (low): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege…
CVE-2026-18246 — CVSS 3.0 (low): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict…
CVE-2024-35122 — CVSS 2.8 (low): IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local…
CVE-2026-17071 — CVSS 2.7 (low): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal.