IBM
- Exploited flaws
- 8in 6 products
- Added to CISA's list in 2026
- 10 in 2025
- Used by ransomware
- 2of 8, says CISA
- Disclosure to CISA's list
- Not yet4 of 4 flaws dated so far; filling in daily
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2013 | 1 |
| 2014 | 0 |
| 2015 | 1 |
| 2016 | 0 |
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 1 |
| 2020 | 3 |
| 2021 | 0 |
| 2022 | 1 |
| 2023 | 0 |
| 2024 | 0 |
| 2025 | 0 |
| 2026 | 1 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Data Risk Manager | 3 | 2021-11-03 | 2021-11-03 |
Latest on CISA's list
- IBM Langflow Code Injection Vulnerability
- IBM Aspera Faspex Code Execution Vulnerability
- IBM InfoSphere BigInsights Invalid Input Vulnerability
- IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
- IBM Data Risk Manager Directory Traversal Vulnerability
- IBM Data Risk Manager Remote Code Execution Vulnerability
- IBM Data Risk Manager Security Bypass Vulnerability
- IBM Planning Analytics Remote Code Execution Vulnerability
In the news
No security story in the last 14 days named IBM in its headline.
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.