https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-84418.htmlhttps://patchthecve.com/cve/CVE-2026-84418.htmlWed, 14 Oct 2026 23:50:00 +0000HIGH 7.4: IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API achttps://patchthecve.com/cve/CVE-2026-82110.htmlhttps://patchthecve.com/cve/CVE-2026-82110.htmlWed, 14 Oct 2026 23:50:17 +0000CRITICAL 9.6: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.https://patchthecve.com/cve/CVE-2026-82108.htmlhttps://patchthecve.com/cve/CVE-2026-82108.htmlWed, 14 Oct 2026 23:50:25 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-82103.htmlhttps://patchthecve.com/cve/CVE-2026-82103.htmlWed, 14 Oct 2026 23:50:51 +0000CRITICAL 9.6: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.https://patchthecve.com/cve/CVE-2026-82101.htmlhttps://patchthecve.com/cve/CVE-2026-82101.htmlWed, 14 Oct 2026 23:51:06 +0000CRITICAL 9.6: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.https://patchthecve.com/cve/CVE-2026-82096.htmlhttps://patchthecve.com/cve/CVE-2026-82096.htmlWed, 14 Oct 2026 23:51:28 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-84421.htmlhttps://patchthecve.com/cve/CVE-2026-84421.htmlFri, 02 Oct 2026 13:47:15 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.https://patchthecve.com/cve/CVE-2026-82094.htmlhttps://patchthecve.com/cve/CVE-2026-82094.htmlTue, 06 Oct 2026 16:15:27 +0000HIGH 7.1: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.https://patchthecve.com/cve/CVE-2026-82093.htmlhttps://patchthecve.com/cve/CVE-2026-82093.htmlTue, 06 Oct 2026 16:15:46 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.https://patchthecve.com/cve/CVE-2026-81552.htmlhttps://patchthecve.com/cve/CVE-2026-81552.htmlTue, 06 Oct 2026 16:16:11 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.https://patchthecve.com/cve/CVE-2026-81549.htmlhttps://patchthecve.com/cve/CVE-2026-81549.htmlTue, 06 Oct 2026 16:19:54 +0000CRITICAL 9.6: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.https://patchthecve.com/cve/CVE-2026-81548.htmlhttps://patchthecve.com/cve/CVE-2026-81548.htmlTue, 06 Oct 2026 16:20:11 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-81547.htmlhttps://patchthecve.com/cve/CVE-2026-81547.htmlTue, 06 Oct 2026 16:12:56 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal.https://patchthecve.com/cve/CVE-2026-81545.htmlhttps://patchthecve.com/cve/CVE-2026-81545.htmlTue, 06 Oct 2026 16:12:58 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-81539.htmlhttps://patchthecve.com/cve/CVE-2026-81539.htmlTue, 06 Oct 2026 16:13:00 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-81537.htmlhttps://patchthecve.com/cve/CVE-2026-81537.htmlTue, 06 Oct 2026 16:13:02 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.https://patchthecve.com/cve/CVE-2026-81536.htmlhttps://patchthecve.com/cve/CVE-2026-81536.htmlTue, 06 Oct 2026 16:13:05 +0000HIGH 7.7: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.https://patchthecve.com/cve/CVE-2026-81208.htmlhttps://patchthecve.com/cve/CVE-2026-81208.htmlTue, 06 Oct 2026 16:13:07 +0000HIGH 7.7: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments.https://patchthecve.com/cve/CVE-2026-80423.htmlhttps://patchthecve.com/cve/CVE-2026-80423.htmlTue, 06 Oct 2026 16:13:09 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts.https://patchthecve.com/cve/CVE-2026-80425.htmlhttps://patchthecve.com/cve/CVE-2026-80425.htmlTue, 06 Oct 2026 16:13:11 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-80412.htmlhttps://patchthecve.com/cve/CVE-2026-80412.htmlTue, 06 Oct 2026 16:13:13 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.https://patchthecve.com/cve/CVE-2026-80379.htmlhttps://patchthecve.com/cve/CVE-2026-80379.htmlTue, 06 Oct 2026 16:13:15 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-17102.htmlhttps://patchthecve.com/cve/CVE-2026-17102.htmlFri, 25 Sep 2026 18:41:37 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-16672.htmlhttps://patchthecve.com/cve/CVE-2026-16672.htmlFri, 25 Sep 2026 18:42:23 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-16469.htmlhttps://patchthecve.com/cve/CVE-2026-16469.htmlFri, 25 Sep 2026 18:42:36 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-16468.htmlhttps://patchthecve.com/cve/CVE-2026-16468.htmlFri, 25 Sep 2026 18:43:15 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection.https://patchthecve.com/cve/CVE-2026-16346.htmlhttps://patchthecve.com/cve/CVE-2026-16346.htmlTue, 06 Oct 2026 16:28:01 +0000CRITICAL 9.9: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-16673.htmlhttps://patchthecve.com/cve/CVE-2026-16673.htmlTue, 06 Oct 2026 15:32:37 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.https://patchthecve.com/cve/CVE-2026-16466.htmlhttps://patchthecve.com/cve/CVE-2026-16466.htmlTue, 06 Oct 2026 15:32:55 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.https://patchthecve.com/cve/CVE-2026-16432.htmlhttps://patchthecve.com/cve/CVE-2026-16432.htmlTue, 06 Oct 2026 15:34:12 +0000HIGH 7.7: IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.https://patchthecve.com/cve/CVE-2026-16428.htmlhttps://patchthecve.com/cve/CVE-2026-16428.htmlTue, 06 Oct 2026 15:36:07 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.https://patchthecve.com/cve/CVE-2026-16338.htmlhttps://patchthecve.com/cve/CVE-2026-16338.htmlTue, 06 Oct 2026 15:39:18 +0000CRITICAL 9.9: IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.https://patchthecve.com/cve/CVE-2026-16335.htmlhttps://patchthecve.com/cve/CVE-2026-16335.htmlTue, 06 Oct 2026 15:44:06 +0000HIGH 8.1: IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability.https://patchthecve.com/cve/CVE-2026-82107.htmlhttps://patchthecve.com/cve/CVE-2026-82107.htmlWed, 16 Sep 2026 00:37:55 +0000CRITICAL 9.6: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication.https://patchthecve.com/cve/CVE-2026-82100.htmlhttps://patchthecve.com/cve/CVE-2026-82100.htmlWed, 16 Sep 2026 00:38:49 +0000CRITICAL 9.6: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.https://patchthecve.com/cve/CVE-2026-82099.htmlhttps://patchthecve.com/cve/CVE-2026-82099.htmlWed, 16 Sep 2026 00:39:21 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-82098.htmlhttps://patchthecve.com/cve/CVE-2026-82098.htmlWed, 16 Sep 2026 00:40:01 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-82097.htmlhttps://patchthecve.com/cve/CVE-2026-82097.htmlWed, 16 Sep 2026 00:40:49 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) vulnerability.https://patchthecve.com/cve/CVE-2026-82095.htmlhttps://patchthecve.com/cve/CVE-2026-82095.htmlWed, 16 Sep 2026 00:41:08 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-82092.htmlhttps://patchthecve.com/cve/CVE-2026-82092.htmlWed, 16 Sep 2026 00:41:54 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.https://patchthecve.com/cve/CVE-2026-81554.htmlhttps://patchthecve.com/cve/CVE-2026-81554.htmlWed, 16 Sep 2026 00:44:18 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.https://patchthecve.com/cve/CVE-2026-81551.htmlhttps://patchthecve.com/cve/CVE-2026-81551.htmlWed, 16 Sep 2026 00:43:28 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability.https://patchthecve.com/cve/CVE-2026-81550.htmlhttps://patchthecve.com/cve/CVE-2026-81550.htmlWed, 16 Sep 2026 00:45:12 +0000HIGH 8.8: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.https://patchthecve.com/cve/CVE-2026-81540.htmlhttps://patchthecve.com/cve/CVE-2026-81540.htmlWed, 16 Sep 2026 00:45:42 +0000HIGH 8.5: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability.https://patchthecve.com/cve/CVE-2026-81210.htmlhttps://patchthecve.com/cve/CVE-2026-81210.htmlWed, 16 Sep 2026 00:46:04 +0000HIGH 7.7: IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinehttps://patchthecve.com/cve/CVE-2026-81207.htmlhttps://patchthecve.com/cve/CVE-2026-81207.htmlWed, 16 Sep 2026 00:45:50 +0000HIGH 8.5: IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an outbound fetch originating from a shared-infrastructure pod, and the WSDL body is reflected verbatim to the caller. The ds-canvas pod sits on https://patchthecve.com/cve/CVE-2026-80436.htmlhttps://patchthecve.com/cve/CVE-2026-80436.htmlWed, 16 Sep 2026 00:48:45 +0000HIGH 8.5: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization.https://patchthecve.com/cve/CVE-2026-80434.htmlhttps://patchthecve.com/cve/CVE-2026-80434.htmlWed, 16 Sep 2026 00:48:26 +0000HIGH 7.4: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference.https://patchthecve.com/cve/CVE-2026-80424.htmlhttps://patchthecve.com/cve/CVE-2026-80424.htmlWed, 16 Sep 2026 00:47:27 +0000CRITICAL 9.1: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.https://patchthecve.com/cve/CVE-2026-80380.htmlhttps://patchthecve.com/cve/CVE-2026-80380.htmlWed, 16 Sep 2026 00:47:10 +0000HIGH 7.1: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery.