MEIFP – Most Exploited Internet-Facing Products

IBM

Products: Aspera Orchestrator · EntireX · Langflow OSS · Operational Decision Manager · Security Verify Access Appliance · Security Verify Access Docker

40.6

Score

CVEs

Active

PoC

KEV

#56

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2026-9198	2026-07-17	9.8v3.1	ACTIVE		Low	None	YES	40.6	Langflow OSS	IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
CVE-2024-54169	2025-02-27	6.5v3.1	POC	—	Low	Low	no	0.0	EntireX	IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVE-2023-27283	2024-05-04	5.3v3.1	POC	—	Low	None	YES	0.0	Aspera Orchestrator	IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545.
CVE-2023-43016	2024-02-03	7.3v3.1	POC	—	Low	None	YES	0.0	Security Verify Access ApplianceSecurity Verify Access Docker	IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password. IBM X-Force ID: 266154.
CVE-2024-22319	2024-02-02	8.1v3.1	POC	—	High	None	YES	0.0	Operational Decision Manager	IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3