https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-14811.htmlhttps://patchthecve.com/cve/CVE-2025-14811.htmlWed, 17 Jun 2026 08:36:35 +0000LOW 3.1: IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.https://patchthecve.com/cve/CVE-2025-13726.htmlhttps://patchthecve.com/cve/CVE-2025-13726.htmlWed, 17 Jun 2026 08:34:39 +0000MEDIUM 5.3: IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.https://patchthecve.com/cve/CVE-2025-13723.htmlhttps://patchthecve.com/cve/CVE-2025-13723.htmlWed, 17 Jun 2026 08:34:38 +0000MEDIUM 5.3: IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access tokenhttps://patchthecve.com/cve/CVE-2025-13718.htmlhttps://patchthecve.com/cve/CVE-2025-13718.htmlWed, 17 Jun 2026 08:34:38 +0000LOW 3.7: IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.https://patchthecve.com/cve/CVE-2025-13702.htmlhttps://patchthecve.com/cve/CVE-2025-13702.htmlWed, 17 Jun 2026 08:34:36 +0000MEDIUM 6.1: IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentihttps://patchthecve.com/cve/CVE-2025-33093.htmlhttps://patchthecve.com/cve/CVE-2025-33093.htmlWed, 17 Jun 2026 09:13:07 +0000HIGH 7.5: IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret.https://patchthecve.com/cve/CVE-2022-35640.htmlhttps://patchthecve.com/cve/CVE-2022-35640.htmlWed, 17 Jun 2026 04:52:00 +0000MEDIUM 4.0: IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned. IBM X-Force ID: 230933.