CVE-2026-10545

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1054525.9Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alte CVE-2026-1054538.4IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privi CVE-2026-1054545.3RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to CVE-2026-1054555.3RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a repor CVE-2026-1054565.3RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely conta CVE-2026-1054576.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversa CVE-2026-1054584.3GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that,CVE-2026-1054596.8IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organizat CVE-2026-105466.5IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/comp CVE-2026-1054605.5A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return CVE-2026-1054617.5Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : CVE-2026-1054648.8IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attac