CVE WatchNov 10, 2026

CVE-2026-18194

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-click

CVSS

2.5

Low

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Nov 8, 2026 · Last modified: Nov 10, 2026 · CWE-1021

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-11-092026-11-10

Technical description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.

Official references

www.ibm.comhttps://www.ibm.com/support/pages/node/7291780

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1022368.6 HIG

—

——0Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.4h CVE-2026-1235294.6 MED

4.6%

——1Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers.5h CVE-2026-1238503.5 LOW

11.0%

——3In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives4d CVE-2026-218343.1 LOW

4.4%

——1HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.8h CVE-2026-1233115.3 MED

3.5%

——1In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible3h CVE-2026-181594.3 MED

10.3%

——3A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking. This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.4d