IBM Planning Analytics Local vulnerabilities

32 CVEs affecting IBM Planning Analytics Local, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-13365, published 2026-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4670, published 2021-05-17. Critical severity, CVSS 9.1. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, running on the remote host is not protected by password authentication. A remote…
CVE-2020-4669, published 2021-05-17. Critical severity, CVSS 9.1. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without…
CVE-2020-4644, published 2020-07-29. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker…
CVE-2021-29739, published 2021-08-10. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. X-Force ID: 198846.
CVE-2020-4985, published 2021-05-14. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. IBM X-Force ID: 192642.
CVE-2018-1676, published 2018-07-06. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2020-4503, published 2020-06-02. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2025-36357, published 2025-11-17. High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing…
CVE-2020-4649, published 2020-11-03. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022.
CVE-2020-4367, published 2020-06-02. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179001.

Latest

CVE-2026-13365, published 2026-08-13. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the…
CVE-2026-10545, published 2026-07-30. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO…
CVE-2026-1267, published 2026-03-17. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls.
CVE-2025-14806, published 2026-03-17. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.
CVE-2025-36437, published 2025-12-09. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
CVE-2025-36299, published 2025-11-17. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system.
CVE-2025-36262, published 2025-09-30. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the…
CVE-2025-36132, published 2025-09-30. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code…
CVE-2025-33005, published 2025-06-01. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.