SQL Injection vulnerability found on ibm.com endpoint #3578842 Valid SQL Injection Critical 2026-03-12 – 137 Potential Subdomain Takeover on IBM.com domain. #3592387 Valid Access Control High 2026-03-24 – 82 Middleware Authentication Bypass on IBM Portal #3088290 Valid Command and Code Injection Critical 2025-05-02 – 80 SSRF via host header let access localhost via https://go.dialexa.com #2696271 Valid No weakness recorded Medium 2024-10-03 – 75 S3 Bucket Takeover on apptio endpoint #2498255 Valid Access Control Medium 2024-06-21 – 72 SSRF and secret key disclosure found on Turbonomic endpoint #2697592 Valid Server-Side Request Forgery High 2024-09-19 – 71 [RCE] Remote Code Execution via React Server Components Vulnerability CVE-2025-55182 #3458235 Valid Command and Code Injection Critical 2025-12-18 – 67 Unauthenticated Remote Access to Testing Endpoint #2192984 Valid Access Control – 2023-12-04 – 67 RXSS in hidden parameter #2090964 Valid Cross-site Scripting – 2024-04-23 – 65 XSS Refelected on jazz.net #2338285 Valid Cross-site Scripting – 2024-02-29 – 64 Path Traversal Vulnerability found on IBM Cloud #3060373 Valid File and Path Handling Critical 2025-05-07 – 63 Remote Code Execution identified on IBM endpoint. #3463045 Valid No weakness recorded Critical 2025-12-31 – 60 Exposed Logs and Bearer Tokens on Test Endpoint #2844797 Valid Information Disclosure – 2024-12-12 – 57 Insecure Direct Object Reference Protection bypass by changing HTTP method in IBM Your Learning endpoint. #2456603 Valid Insecure Direct Object Reference – 2024-05-01 – 57 IDOR in upload videos of a Channel on https://video.ibm.com #2085185 Valid Insecure Direct Object Reference – 2023-08-31 – 57 SSRF and secret key disclosure found on Turbonomic endpoint #2697601 Valid Server-Side Request Forgery High 2024-09-19 – 56 SQL Injection in IBM access control panel & Broken access in admin panel #1355817 Valid SQL Injection – 2021-10-18 – 54 XSS in Aspera documentation website #2308491 Valid Cross-site Scripting – 2024-05-06 – 52 Information disclosure on IBM training service endpoint #3051155 Valid Insecure Direct Object Reference – 2025-04-29 – 49 IBM OpenPages vulnerable to exposure of sensitive information #2501986 Valid Authentication Medium 2024-10-01 – 49 Remote Code Execution at https://169.38.86.185/ (edst.ibm.com) #1379130 Valid Command and Code Injection – 2021-11-04 – 49 IBM Aspera HTTP Gateway stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. #3340797 Valid Information Disclosure High 2026-04-27 – 46 POST based Cross-Site Scripting on IBM research endpoint #2899380 Valid Cross-site Scripting Medium 2025-01-23 – 44 jazz.net - publicly accessible .svn repositories #2398335 Valid Information Disclosure – 2024-08-16 – 43 Reflected XSS and Blind out of band command injection at subdomain dstuid-ww.dst.ibm.com #410334 Valid Command and Code Injection – 2022-02-04 – 42 sql injection via https://setup.p2p.ihost.com/ #1567516 Valid SQL Injection – 2022-06-17 – 41 Weak credentials found in Jenkins endpoint #2954547 Valid No weakness recorded Critical 2025-02-05 – 40 Information disclosure identified on IBM endpoint. #2402842 Valid Information Disclosure Medium 2025-07-08 – 39 XSS in IBM InfoCenter #2343548 Valid Cross-site Scripting Medium 2024-07-17 – 39 Jenkins server access due to weak password #2139047 Valid Authentication – 2024-02-29 – 39 There is a POST based CSRF issue over IBM endpoint leading to modification of contact information. #2919623 Valid Cross-Site Request Forgery Medium 2025-02-04 – 38 IBM Maximo Asset Management could allow a remote attacker to bypass authentication due to improper access controls #1933304 Valid Access Control – 2024-02-06 – 37 SQL Injection vulnerability found on IBM.com subdomain #3730301 Valid SQL Injection – 2026-10-16 – 36 Improper Authentication on Alertmanager instance #2292236 Valid Authentication – 2024-02-29 – 36 SQL injection in URL path processing on www.ibm.com #1527284 Valid SQL Injection – 2022-05-06 – 35 SQL Injection found on ibm.com subdomain #3662095 Valid SQL Injection Critical 2026-10-12 – 33 response manipulation leads to bypass in register at employee website than 0 click account takeover #1994227 Valid Authentication – 2023-06-21 – 32 Cleartext storage of sensitive information at https://staging.status.ai-apps-comms.ibm.com/env can lead to account takeover of several IBM employees #1670586 Valid Cryptography – 2022-09-09 – 31 Reflected Cross-Site Scripting (XSS) found on IBM.com domain #3664261 Valid Cross-site Scripting – 2026-06-15 – 29 Subdomain Takeover Affecting at vex.weather.com #1954364 Valid Authentication – 2023-05-10 – 26 Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint #3909372 Valid Access Control – 2026-08-28 – 25 Public Jenkins instance with /script enabled #1492447 Valid Access Control – 2022-03-11 – 16 CVE-2020-3452 Cisco ASA / Firepower Read-Only Path Traversal Vulnerability - https://esccvc.de.ibm.com #938684 Valid File and Path Handling – 2022-03-11 – 16 Insecure Object Permissions for Guest User leads to access to internal documents! #1089583 Valid Authentication – 2022-07-15 – 15 Unauthorized Kubernetes to RCE (root) and found TEAMTNT Crypto Miner on it #1317236 Valid No weakness recorded – 2021-10-18 – 12 Moodle XSS on s-immerscio.comprehend.ibm.com #1848551 Valid Cross-site Scripting – 2023-05-11 – 11 SQL Injection and plaintext passwords via User Search #703819 Valid SQL Injection – 2022-01-14 – 11 Path Traversal vulnerability identified on IBM endpoint. #3432159 Valid No weakness recorded High 2026-01-12 – 10