CVE-2026-18513

HighCVSS 7.2/10Last modified Oct 14, 2026

Description

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
IBMMaximo Application Suite - Location Service for Esri Component9.2; 9.1; 9.0

References

Timeline

Published
Oct 12, 2026
Last modified
Oct 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-185154.3IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they CVE-2026-185169.6An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform storeCVE-2026-185177.7IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for EsrCVE-2026-18526.1The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,CVE-2026-185254.9IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validationCVE-2026-185267.4HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation renderinCVE-2026-185279.9IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privCVE-2026-185298.7IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper saniCVE-2026-18536.4The BuddyHolis ListSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listsearch' shortcode in all vCVE-2026-185315.3IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC sessiCVE-2026-185336.5IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unCVE-2026-185347.4ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled con