ByteOS Network

Vulnerability Details :

CVE-2025-13995

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-19 Mar, 2026 | 01:55

Updated At-20 Mar, 2026 | 18:11

IBM QRadar SIEM Information Disclosure

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:ibm

Assigner Org ID:9a959283-ebb5-44b6-b705-dcc2bbced522

Published At:19 Mar, 2026 | 01:55

Updated At:20 Mar, 2026 | 18:11

▼CVE Numbering Authority (CNA)

IBM QRadar SIEM Information Disclosure

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account.

Affected Products

Vendor

IBM Corporation

Product

QRadar

CPEs

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:*

Default Status

unaffected

Versions

Affected

From 7.5.0 through 7.5.0 Update Pack 14 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-1286	CWE-1286 Improper validation of syntactic correctness of input

Type: CWE

CWE ID: CWE-1286

Description: CWE-1286 Improper validation of syntactic correctness of input

Metrics

Version	Base score	Base severity	Vector
3.1	5.0	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Version: 3.1

Base score: 5.0

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Solutions

ProductVersionFixIBM QRadar SIEM 7.5.0 7.5.0 UP15 https://www.ibm.com/support/fixcentral/swg/selectFixes ( Release Notes https://www.ibm.com/support/pages/node/7257011 )

References

Hyperlink	Resource
https://www.ibm.com/support/pages/node/7266709	vendor-advisory patch

Hyperlink: https://www.ibm.com/support/pages/node/7266709

Resource:

vendor-advisory

patch

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@us.ibm.com

Published At:19 Mar, 2026 | 03:16

Updated At:23 Mar, 2026 | 18:07

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.0	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Type: Primary

Version: 3.1

Base score: 5.0

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CPE Matches

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-1286	Primary	psirt@us.ibm.com

CWE ID: CWE-1286

Type: Primary

Source: psirt@us.ibm.com

References

Hyperlink	Source	Resource
https://www.ibm.com/support/pages/node/7266709	psirt@us.ibm.com	Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/7266709

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

Similar CVEs

3Records found

CVE-2026-7573

Matching Score-8

Assigner-Rapid7, Inc.

View Details

Matching Score-8

Assigner-Rapid7, Inc.

CVSS Score-5||MEDIUM

EPSS-0.01% / 1.45%

7 Day CHG~0.00%

Published-06 May, 2026 | 02:15

Updated-01 Jun, 2026 | 16:58

GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations

An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request.

Vendor-Velocidex Linux Kernel Organization, Inc Rapid7 LLC

Product-linux_kernel velociraptor velociraptor

CWE ID-CWE-639

Authorization Bypass Through User-Controlled Key

CVE-2024-52362

Matching Score-6

Assigner-IBM Corporation

View Details

Matching Score-6

Assigner-IBM Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 11.32%

7 Day CHG~0.00%

Published-12 Mar, 2025 | 14:04

Updated-01 Sep, 2025 | 01:06

IBM App Connect Enterprise Certified Container denial of service

IBM App Connect Enterprise Certified Container 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, and 12.8 could allow an authenticated user to cause a denial of service in the App Connect flow due to improper validation of server-side input.

Vendor-IBM Corporation

Product-app_connect_operator app_connect_enterprise_certified_containers_operands App Connect Enterprise Certified Container

CWE ID-CWE-1286

Improper Validation of Syntactic Correctness of Input

CVE-2025-36262

Matching Score-6

Assigner-IBM Corporation

View Details

Matching Score-6

Assigner-IBM Corporation

CVSS Score-4.9||MEDIUM

EPSS-0.07% / 20.68%

7 Day CHG+0.01%

Published-30 Sep, 2025 | 19:42

Updated-03 Oct, 2025 | 17:52

IBM Planning Analytics Local information disclosure

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics Local

CWE ID-CWE-1286

Improper Validation of Syntactic Correctness of Input

CVE-2025-13995

Credits

IBM QRadar SIEM Information Disclosure

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs