How many CVEs does IBM have?

IBM has 8,380 published CVE records since 1999, including 982 in the last two years.

How many IBM CVEs are in CISA KEV?

Yes — 10 of IBM's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which IBM products have the most CVEs?

The IBM products with the most published CVEs are AIX, WebSphere Application Server, Db2, Rational Quality Manager, Infosphere Information Server.

What are the most common weakness types in IBM CVEs?

IBM's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-209 (Generation of Error Message Containing Sensitive Information), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Are there public exploits for IBM vulnerabilities?

Yes — 316 of IBM's CVEs have a known public exploit.

How many critical IBM vulnerabilities are there?

IBM has 740 critical and 2,120 high-severity CVEs.

What is the average severity of IBM CVEs?

The average CVSS base score across IBM's scored CVEs is 6.2.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

8,380 CVEs

10 in CISA KEV

IBM Vulnerabilities

Name: IBM vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for IBM.

8,380

Total CVEs

Published

10

In CISA KEV

Exploited in the wild

316

Public exploits

PoC or exploit code

6.2

Avg CVSS

1999–2026

Overview

IBM has 8,380 published CVE records since 1999, of which 10 are in CISA's Known Exploited Vulnerabilities catalog and 316 have a known public exploit. The average CVSS base score across scored CVEs is 6.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting IBM products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on IBM's vulnerability posture, as a share of its 8,380 published CVEs.

Average CVSS: 6.2
Critical / high: 34%
Actively exploited (KEV): 0%
Public exploit available: 4%
Patch available: 45%

Severity and exploitation

How the CVSS severity of IBM's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical740

High2,120

Medium4,862

Low657

1 additional CVE has no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

10

10 of IBM's CVEs are confirmed exploited in the wild.

Public exploits

316

316 of IBM's CVEs have a known public exploit available.

Most affected products

The IBM products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in IBM CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish IBM CVE records.

Disclosure activity by year

How many IBM CVEs were published each year.

2019

478

2020

577

2021

608

2022

416

2023

416

2024

511

2025

609

2026

373

Latest IBM CVEs

The most recently disclosed vulnerabilities affecting IBM.

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
CWE-639
High · CVSS 8.1
EPSS 0.2%2026-07-17
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
CWE-798
Critical · CVSS 9.8
EPSS 0.2%2026-07-17
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
High · CVSS 8.1
EPSS 0.4%2026-07-17
IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow
High · CVSS 8.1
EPSS 0.5%2026-07-17
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
CWE-78
High · CVSS 8.8
EPSS 0.4%2026-07-17
Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub
CWE-676
Medium · CVSS 4.3
EPSS 0.3%2026-07-17
This PowerVM Novalink update is being released to address
CWE-16
Low · CVSS 3.9
EPSS 0.1%2026-07-17
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
CWE-776
Medium · CVSS 5.3
EPSS 0.4%2026-07-17
Multiple Vulnerabilities in IBM Engineering AI hub.
CWE-78
Medium · CVSS 5.4
EPSS 0.3%2026-07-17
Multiple Vulnerabilities in IBM Engineering AI hub.
CWE-79
Critical · CVSS 9.3
EPSS 0.6%2026-07-17
Multiple Vulnerabilities in IBM Engineering AI hub.
CWE-601
Medium · CVSS 4.3
EPSS 0.4%2026-07-17
Multiple Vulnerabilities in IBM Engineering AI hub.
CWE-598
High · CVSS 7.5
EPSS 0.5%2026-07-17

Track new IBM CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor IBM CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Oracle10,707 CVEs Debian10,221 CVEs Red Hat7,778 CVEs Adobe7,522 CVEs Cisco6,845 CVEs Fedora Project5,449 CVEs canonical4,320 CVEs mozilla3,666 CVEs

Browse all vendors

Frequently asked questions

Common questions about IBM vulnerabilities.

How many CVEs does IBM have?: IBM has 8,380 published CVE records since 1999, including 982 in the last two years.
How many IBM CVEs are in CISA KEV?: Yes — 10 of IBM's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which IBM products have the most CVEs?: The IBM products with the most published CVEs are AIX, WebSphere Application Server, Db2, Rational Quality Manager, Infosphere Information Server.
What are the most common weakness types in IBM CVEs?: IBM's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-209 (Generation of Error Message Containing Sensitive Information), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for IBM vulnerabilities?: Yes — 316 of IBM's CVEs have a known public exploit.
How many critical IBM vulnerabilities are there?: IBM has 740 critical and 2,120 high-severity CVEs.
What is the average severity of IBM CVEs?: The average CVSS base score across IBM's scored CVEs is 6.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track IBM vulnerabilities

Monitor new IBM vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing