Export limit exceeded: 25230 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (75 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-75063 1 Ibm 1 Planning Analytics 2026-10-13 5.4 Medium
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.
CVE-2026-75061 1 Ibm 1 Planning Analytics 2026-10-13 7.5 High
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.
CVE-2026-19627 1 Ibm 1 Planning Analytics 2026-10-13 8.2 High
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.
CVE-2026-19622 1 Ibm 1 Planning Analytics 2026-10-13 8.8 High
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
CVE-2026-19620 1 Ibm 1 Planning Analytics 2026-10-13 8.8 High
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.
CVE-2026-18541 1 Ibm 1 Planning Analytics 2026-10-13 6.4 Medium
IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2026-17475 1 Ibm 1 Planning Analytics 2026-10-13 7.1 High
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.
CVE-2026-85457 1 Ibm 1 Planning Analytics 2026-10-12 8.1 High
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-13365 1 Ibm 2 Planning Analytics, Planning Analytics Local 2026-08-17 7.1 High
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2026-10545 1 Ibm 1 Planning Analytics Local 2026-08-12 7.5 High
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.
CVE-2025-36105 1 Ibm 1 Planning Analytics Advanced Certified Containers 2026-05-06 4.4 Medium
IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain sensitive information from environment variables.
CVE-2025-14806 2 Ibm, Microsoft 2 Planning Analytics Local, Windows 2026-03-24 5.7 Medium
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.
CVE-2026-1267 2 Ibm, Microsoft 2 Planning Analytics Local, Windows 2026-03-24 6.5 Medium
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls.
CVE-2025-36357 1 Ibm 2 Planning Analytics Local, Planning Analytics Workspace 2026-02-26 8 High
IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system.
CVE-2025-36437 1 Ibm 1 Planning Analytics Local 2026-01-14 4.3 Medium
IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
CVE-2019-4716 1 Ibm 1 Planning Analytics 2026-01-14 9.8 Critical
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
CVE-2025-36299 1 Ibm 2 Planning Analytics Local, Planning Analytics Workspace 2025-11-19 4.3 Medium
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system.
CVE-2025-36262 1 Ibm 1 Planning Analytics Local 2025-10-03 4.9 Medium
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input.
CVE-2025-36132 1 Ibm 1 Planning Analytics Local 2025-10-03 5.4 Medium
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-25044 1 Ibm 1 Planning Analytics Local 2025-08-26 5.4 Medium
IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.