CVE-2025-36076

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-540

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	Cognos Analytics	>= 12.1.0, <= 12.1.3 FP1; >= 12.0.4, <= 12.0.4 FP2

References

https://www.ibm.com/support/pages/node/7287209

Timeline

Published: Sep 18, 2026
Last modified: Oct 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-36086.5A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitab CVE-2025-360815.3IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input.CVE-2025-360823.3IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.CVE-2025-360835.5IBM Concert Software 1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of CVE-2025-360847.5IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive CVE-2025-360855.4IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to se CVE-2025-360879.8IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under cert CVE-2025-360885.4IBM TS4500 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allow CVE-2025-36095.3The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is CVE-2025-360905.3IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which c CVE-2025-360914.3IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessibl CVE-2025-360926.5IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the i