AI and data stack advisories

Severe, 6 weeks1490Projects326

1490 severe, 6 weeks · 326 projects

IBMCVE-2026-3303

IBM Concert: attacker could carry out privileged actions as the domain

IBM

CVE-2026-3303 · Published Oct 19, 2026 · updated Nov 3, 2026

Low3.7
No fix yet
IBM advisory

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.

Affected versions

PackageAffectedFixed in
Concert
Product
>= 1.0.0, <= 3.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-942

More IBM advisories

All IBM
Medium 6.5Oct 19IBM Storage TS4500 Library: denial of serviceCVE-2025-36061no fix yetMedium 5.5Oct 19IBM Storage TS4500 Library: insufficient session expirationCVE-2025-36069no fix yetMedium 6.3Oct 19IBM Storage TS4500 Library: insufficient session expirationCVE-2025-36252no fix yetHigh 7.5Oct 19IBM Concert: information disclosureCVE-2026-6719no fix yetMedium 5.3Oct 19IBM Concert: information disclosureCVE-2026-3628no fix yetMedium 4.0Oct 19IBM Concert 1.0 through 3.0.0CVE-2026-4405no fix yet