CVE-2026-1037

MediumCVSS 6.1/10Last modified Sep 18, 2026

Description

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	Common Licensing	Agent 9.0; Agent 9.0.0.1; Agent 9.0.0.2; ART 9.0; ART 9.0.0.1; ART 9.0.0.2

References

https://www.ibm.com/support/pages/node/7286490

Timeline

Published: Sep 18, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1037529.8Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.CVE-2026-1037545.9A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of th CVE-2026-1037577.7Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packag CVE-2026-1037588.1Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the c CVE-2026-1037605.9Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to blo CVE-2026-1037617.5Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows CVE-2026-1037625.3SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSaveP CVE-2026-1037635.8SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-exc CVE-2026-1037649.8Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated at CVE-2026-1037659.4Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unau CVE-2026-1037667.2ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission t CVE-2026-1037689.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, a