CVE-2026-15322

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS probability

0.52%

CWE

CWE-598

Published

2026-07-17

Last modified

2026-07-21

Affected products

• IBM Engineering AI Hub
• IBM Engineering AI Hub
• IBM Engineering AI Hub

Weakness type

• CWE-598

Related vulnerabilities

• CVE-2026-61614 — SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history
• CVE-2026-82181 — Le-yan｜Medical Practice Management System - Sensitive Data in URL
• CVE-2026-76179 — Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings
• CVE-2026-63408 — Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
• CVE-2026-74880 — openssl_encrypt before 1.4.0 Token Leakage via Query Parameters
• CVE-2026-66832 — Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
• CVE-2026-14838 — Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources
• CVE-2026-47768 — nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

Markdown version · Browse all CVEs