CVE-2026-15069

MediumCVSS 5.4/10Last modified Oct 24, 2026

Description

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-15077.5The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI serviceCVE-2026-150708.8The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includinCVE-2026-150726.5The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameCVE-2026-150736.5The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameCVE-2026-150747.5@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution staCVE-2026-150757.5In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates alCVE-2026-150767.5In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client doesCVE-2026-150774.3GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditiCVE-2026-150788.1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper vCVE-2026-150795.4Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects LoginCVE-2026-15084.3The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers toCVE-2026-150804.3Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects R
CVE-2026-15069: Medium severity, CVSS 5.4 | Vulnix