Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Advisory: IBM Planning Analytics — ibm.com/support/pages/node/7291604 Clear all filters
TI-2026-71435 CVE-2026-17475 · GHSA-pq2h-53rx-hm3r

IBM Planning Analytics flaw lets users delete other users' folders

Priority LOW 31

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00218 Published 2026-10-12 No fix listed CWE-285
TI-2026-71436 CVE-2026-18541 · GHSA-h4vg-j58m-p5qp

IBM Planning Analytics Local stored XSS in Web UI

Priority LOW 27

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00136 Published 2026-10-12 No fix listed CWE-79
TI-2026-71437 CVE-2026-19620 · GHSA-gm97-fvj6-6rxr

Authentication bypass in IBM Planning Analytics Local

Priority MEDIUM 40

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00336 Published 2026-10-12 No fix listed CWE-288
TI-2026-71438 CVE-2026-19622 · GHSA-73c5-qf5f-mp9w

Authentication bypass in IBM Planning Analytics Local

Priority MEDIUM 43

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00349 Published 2026-10-12 No fix listed CWE-288
TI-2026-71441 CVE-2026-75063 · GHSA-hfc3-6gg7-rwf3

Cross-site scripting in IBM Planning Analytics

Priority LOW 24

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00177 Published 2026-10-12 No fix listed CWE-79
TI-2026-71439 CVE-2026-19627 · GHSA-qcr6-xqfp-3rhr

Path traversal in IBM Planning Analytics exposes host files

Priority MEDIUM 42

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00354 Published 2026-10-12 No fix listed CWE-22