AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-11918

IBM ContextForge MCP Gateway: incomplete denylist

IBM

CVE-2026-11918 · Published Sep 15, 2026 · updated Nov 9, 2026

Medium5.4
No fix yet
IBM advisory

IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content.

Affected versions

PackageAffectedFixed in
ContextForge MCP Gateway
Product
<= <= v1.0.4No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-184

More IBM advisories

All IBM
Medium 5.4Sep 15IBM Cloud Pak for Business Automation: cross-site scriptingCVE-2026-12751no fix yetHigh 7.1Sep 15IBM Business Automation Workflow containers and traditional: XML external entityCVE-2026-12752no fix yetHigh 7.5Sep 15IBM Security Verify Access: denial of serviceCVE-2026-12358no fix yetHigh 8.1Sep 15IBM MQ: information disclosureCVE-2026-12666no fix yetHigh 7.1Sep 15IBM MQ: denial of serviceCVE-2026-12667no fix yetHigh 8.8Sep 15IBM MQ: code executionCVE-2026-12728no fix yet