CVE-2026-15093— Multiple Vulnerabilities in IBM Engineering AI hub.
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IBM | Engineering AI Hub | 1.0.0 | affected |
1.1.0 | affected | ||
1.2.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15093
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple Vulnerabilities in IBM Engineering AI hub.
Source: CVE Program / CVE List V5
Vulnerability Description
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
IBM Engineering AI Hub 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM Engineering AI Hub是美国IBM公司的一款Engineering Lifecycle Management (ELM)平台的人工智能附加组件。 IBM Engineering AI Hub 1.0.0版本、1.1.0版本和1.2.0版本存在输入验证错误漏洞，该漏洞源于对用户提供的URL验证不当，可能导致远程攻击者将用户重定向到恶意网站。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | Engineering AI Hub | 1.0.0 | cpe:2.3:a:ibm:engineering_ai_hub:1.0.0:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-15093
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15093
请登录查看更多情报信息。
Same Patch Batch · IBM · 2026-07-17 · 34 CVEs total
| CVE-2026-8476 | 9.9 CRITICAL | Disk Cache Deserialization Remote Code Execution Vulnerability |
| CVE-2026-8481 | 9.9 CRITICAL | Remote Code Execution via Code Validation Endpoint |
| CVE-2026-8635 | 9.9 CRITICAL | Arbitrary Code Execution in Python Interpreter Component |
| CVE-2026-9135 | 9.9 CRITICAL | Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation |
| CVE-2026-8859 | 9.9 CRITICAL | Path Traversal in APIRequest Component via Content-Disposition Header |
| CVE-2026-13446 | 9.8 CRITICAL | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-8505 | 9.8 CRITICAL | Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution |
| CVE-2026-9202 | 9.8 CRITICAL | Unauthenticated User Registration Could Lead to Remote Code Execution |
| CVE-2026-9198 | 9.8 CRITICAL | Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation |
| CVE-2026-9103 | 9.8 CRITICAL | Unauthenticated Superuser Token Issuance via Auto-Login Endpoint |
| CVE-2026-15091 | 9.3 CRITICAL | Multiple Vulnerabilities in IBM Engineering AI hub. |
| CVE-2026-14499 | 8.8 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-7667 | 8.8 HIGH | Path Traversal Vulnerability in API Request Component Content-Disposition Header Processin |
| CVE-2026-7755 | 8.8 HIGH | MCP Server Configuration Validator Bypass via File Upload API |
| CVE-2026-8056 | 8.8 HIGH | Parameter Injection Vulnerability in API Graph Execution Engine |
| CVE-2026-13445 | 8.1 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-13473 | 8.1 HIGH | IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow |
| CVE-2026-13448 | 8.1 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-9762 | 7.8 HIGH | IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc |
| CVE-2026-7754 | 7.7 HIGH | SSRF Protection Configuration Vulnerability |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: IBM
- CVE-2026-3482
IBM Sterling B2B Integrator and IBM Sterling File Gateway Au - CVE-2026-13445
Langflow is affected by remote code execution, denial of ser - CVE-2026-13446
Langflow is affected by remote code execution, denial of ser - CVE-2026-13448
Langflow is affected by remote code execution, denial of ser - CVE-2026-13473
IBM Storage Protect Client is vulnerable to Heap-Based Buffe
Same weakness: CWE-601
- CVE-2026-48012
Shopware SSO referer trust leading to an arbitrary redirect - CVE-2026-8152
Unblu Spark Open Redirect leading to DOM-Based XSS - CVE-2026-8284
Open Redirect in Universal Sotware's FlexCity - CVE-2026-16336
trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect - CVE-2026-63768
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via
V. Comments for CVE-2026-15093
No comments yet