CVE-2026-109158

HighCVSS 7.5/10Last modified Nov 13, 2026

Description

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-109166.1Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised CVE-2026-1091604.3A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the f CVE-2026-1091614.9Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.CVE-2026-1091626.3Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder CVE-2026-109163Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP S CVE-2026-1091647.1TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other use CVE-2026-1091654.3TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' f CVE-2026-1091666.5lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs CVE-2026-1091674.3TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authentica CVE-2026-1091686.5lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business CVE-2026-1091696.5LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via t CVE-2026-109178.3Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th