Known vulnerabilities in webMethods BPM
Vendor:
IBM Corporation
Software:
webMethods BPM
Software CPE:
cpe:2.3:a:ibm_corporation:webmethods_bpm:*:*:*:*:*:*:*:*
Website:
https://www.ibm.com/us-en
Total vulnerabilities:
60
Public exploits:
8
Known exploited (KEV):
1
Breakdown by Severity Chart
Vulnerabilities (60)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU146454 - Observable discrepancy CVE-2026-59640 |
CWE-203 | Medium | 10.15 Fix 18, 11.1 Fix 9 | 31.08.2026 |
SB2026083171 SB20260831105 SB2026090816 and 3 more |
||
| #VU146457 - Protection Mechanism Failure CVE-2026-59643 |
CWE-693 | Medium | 10.15 Fix 18, 11.1 Fix 9 | 31.08.2026 |
SB2026083171 SB20260831105 SB2026091416 and 1 more |
||
| #VU146459 - Uncontrolled Recursion CVE-2026-59645 |
CWE-674 | Medium | 10.15 Fix 18, 11.1 Fix 9 | 31.08.2026 |
SB2026083171 SB20260831105 SB2026091409 and 8 more |
||
| #VU146462 - Resource exhaustion CVE-2026-59648 |
CWE-400 | Medium | 10.15 Fix 18, 11.1 Fix 9 | 31.08.2026 |
SB2026083171 SB20260831105 SB2026090816 and 8 more |
||
| #VU146463 - Uncontrolled Memory Allocation CVE-2026-59649 |
CWE-789 | Medium | 10.15 Fix 18, 11.1 Fix 9 | 31.08.2026 |
SB2026083171 SB20260831105 SB2026090816 and 3 more |
||
| #VU146440 - Insufficient Verification of Data Authenticity CVE-2026-12817 |
CWE-345 | Medium | 10.15 Fix 18, 11.1 Fix 9 | 31.08.2026 |
SB2026083171 SB20260831105 SB2026091416 and 2 more |
||
| #VU128402 - Improper Encoding or Escaping of Output CVE-2026-34480 |
CWE-116 | Medium | 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1 | 28.04.2026 |
SB20260428217 SB20260513128 SB2026052632 and 22 more |
||
| #VU128401 - Improper Encoding or Escaping of Output CVE-2026-34479 |
CWE-116 | Medium | 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1 | 28.04.2026 |
SB20260428217 SB20260513128 SB2026052632 and 20 more |
||
| #VU128400 - Improper Output Neutralization for Logs CVE-2026-34478 |
CWE-117 | Medium | 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1 | 28.04.2026 |
SB20260428217 SB2026052632 SB2026052731 and 19 more |
||
| #VU128399 - Improper Certificate Validation CVE-2026-34477 |
CWE-295 | Medium | 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1 | 28.04.2026 |
SB20260428217 SB20260513128 SB2026052632 and 22 more |
||
| #VU126752 - Improper input validation CVE-2026-27727 |
CWE-20 | High | 11.1 Fix 6 | 22.04.2026 |
SB20260422128 SB20260422169 SB20260422170 and 8 more |
||
| #VU126753 - Deserialization of Untrusted Data CVE-2026-27830 |
CWE-502 | Medium | 11.1 Fix 6 | 22.04.2026 |
SB20260422128 SB20260422168 SB20260422170 and 8 more |
||
| #VU123883 - Resource exhaustion CVE-2025-66453 |
CWE-400 | Low | 11.1 Fix 2 | 11.03.2026 |
SB2026031137 SB2026031139 SB2026032529 and 4 more |
||
| #VU120231 - Improper Validation of Certificate with Host Mismatch CVE-2025-68161 |
CWE-297 | Medium | 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1 | 22.12.2025 |
SB2025122245 SB2026012084 SB2026012087 and 102 more |
||
| #VU86800 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2023-4218 |
CWE-611 | Low | 12.1 Fix 1 | 26.02.2024 |
SB2024022642 SB2024030105 SB2024032906 and 11 more |
||
| #VU75217 - Improper input validation CVE-2023-26049 |
CWE-20 | Low | 10.15 Fix 15, 11.1 Fix 3 | 18.04.2023 |
SB2023041842 SB2023051821 SB2023060836 and 78 more |
||
| #VU65831 - Improper input validation CVE-2022-2047 |
CWE-20 | Low | 10.15 Fix 15, 11.1 Fix 3 | 27.07.2022 |
SB2022072723 SB2022080103 SB2022080260 and 41 more |
||
| #VU53973 - Improper input validation CVE-2021-28169 |
CWE-20 | Medium | 10.15 Fix 15, 11.1 Fix 3 | 09.06.2021 |
SB2021060910 SB2021061815 SB2021081922 and 36 more |
||
| #VU52385 - Improper input validation CVE-2020-27223 |
CWE-20 | Medium | 10.15 Fix 15, 11.1 Fix 3 | 21.04.2021 |
SB2021042107 SB2021063002 SB2021063034 and 19 more |
||
| #VU52252 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2021-29425 |
CWE-22 | Low | 11.1 Fix 1 | 15.04.2021 |
SB2021041510 SB2021081922 SB2021093016 and 122 more |
Showing elements 1 - 20 out of 60