Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Sep 10, 2026IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data.CVE-2026-2310 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- Product
- webMethods Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserializatCVE-2026-12118 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
- Product
- webMethods Integration (on prem)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable toCVE-2025-14290 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- webMethods Integration (on prem) -Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly vaCVE-2026-2606 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.
- Product
- webMethods API Gateway (on-prem)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026IBM webMethods Integration Server 12.0 is vulnerable to HTML injection.CVE-2025-14289 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
- Product
- webMethods Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026IBM webMethods Integration (on prem) - Integration Server 10.15 through IS_10.15_Core_Fix2411.1 to IS_11.1_Core_Fix8 IBM webMethods Integration could disclose sCVE-2025-14150 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM webMethods Integration (on prem) - Integration Server 10.15 through IS_10.15_Core_Fix2411.1 to IS_11.1_Core_Fix8 IBM webMethods Integration could disclose sensitive user information in server responses.
- Product
- webMethods Integration (on prem) - Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an aCVE-2025-36072 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improperCVE-2025-36202 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external source.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF).CVE-2025-36037 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data.CVE-2025-36049 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands.
- Product
- webMethods Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due toCVE-2025-36048 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges.
- Product
- webMethods Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach tCVE-2024-23733 · Other software · reported by MITREHigh 7.5
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating sysCVE-2024-45076 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating system.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administratorCVE-2024-45075 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrator due to missing authentication.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system.CVE-2024-45074 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x.CVE-2023-6578 · Other software · Software AG · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup may request username and password. By just clicking CANCEL you will be redirected to the directory. If you visited /invoke/wm.server/connect, you'll be able to see details like internal IPs, ports, and versions. In some cases if access to /assets/ is refused, you may enter /assets/x as a wrong value, then come back to /assets/ which we will show the requested data. It appears that insufficient access control is depending on referrer header data. VDB-247158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WebMethods
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default) CVE-2023-0925 · Other software · Software AG · reported by cret@cert.orgCritical 9.8
Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default) and two RMI interfaces (listening on a single, dynamically assigned TCP high port). Port 2099 serves as a Java Remote Method Invocation (RMI) registry which allows for remotely loading and processing data via RMI interfaces. An unauthenticated attacker with network connectivity to the RMI registry and RMI interface ports can abuse this functionality to instruct the webMethods OneData application to load a malicious serialized Java object as a parameter to one of the available Java methods presented by the RMI interface. Once deserialized on the vulnerable server, the malicious code runs as whichever operating system account is used to run the software, which in most cases is the local System account on Windows.
- Product
- webMethods OneData
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwareag.comsoftwareag.com
Apr 16, 2007Directory traversal vulnerability in /console in the Management Console in webMethods Glue 6.5.1 and earlier allows remote attackers to read arbitrary system fiCVE-2007-2048 · Other software · Webmethods · reported by MITREMedium 5
Directory traversal vulnerability in /console in the Management Console in webMethods Glue 6.5.1 and earlier allows remote attackers to read arbitrary system files via a .. (dot dot) in the resource parameter.
- Product
- Glue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.