IBM Applinx vulnerabilities

15 CVEs affecting IBM Applinx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36419, published 2026-01-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-49796, published 2025-02-06. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to…
CVE-2024-49798, published 2025-02-06. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks…
CVE-2024-49797, published 2025-02-06. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability…
CVE-2025-36419, published 2026-01-20. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system.
CVE-2024-49793, published 2025-02-06. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-49792, published 2025-02-06. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-49791, published 2025-02-06. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-49800, published 2025-02-06. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user.
CVE-2025-36408, published 2026-01-20. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2025-36410, published 2026-01-20. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security.

Latest

CVE-2025-36418, published 2026-01-20. Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to…
CVE-2025-36411, published 2026-01-20. Low severity, CVSS 3.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2025-36409, published 2026-01-20. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…