- How many CVEs does IBM have?
- IBM has 9,452 published CVE records since 1999, including 2,054 in the last two years.
- How many IBM CVEs are in CISA KEV?
- Yes — 11 of IBM's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
- Which IBM products have the most CVEs?
- The IBM products with the most published CVEs are AIX, WebSphere Application Server, Db2, i, VIOS.
- What are the most common weakness types in IBM CVEs?
- IBM's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-264, CWE-20 (Improper Input Validation).
- Are there public exploits for IBM vulnerabilities?
- Yes — 433 of IBM's CVEs have a known public exploit.
- How many critical IBM vulnerabilities are there?
- IBM has 941 critical and 2,659 high-severity CVEs.
- What is the average severity of IBM CVEs?
- The average CVSS base score across IBM's scored CVEs is 6.3.