Engineering Lifecycle Management vulnerabilities | LiveThreat CVE Feed

Product

Engineering Lifecycle Management

by IBM · last CVE Jul 17, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities49 In the news0 Timeline

Severity mix

Critical 1High 6Medium 42Low 0

Severity

All severities49 Critical1 High6 Medium42 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Engineering Lifecycle Management to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-3660	9.8	1%	May 26	IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass Affected: 7.0.3 through Interim Fix 021; 7.1.0 through Interim Fix 009; 7.2.0 through Interim Fix 001
CVE-2020-4495	8.8	3%	Jun 2	IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control Affected: 7.0; 7.0.1; 7.0.2
CVE-2026-14979	7.5	1%	Jul 17	IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack Affected: 7.0.3 ( Interim Fix 001 through ) Interim Fix 021; 7.1.0 ( Interim Fix 001 through ) Interim Fix 009; 7.2.0 and 7.2.0 Interim Fix 001
CVE-2020-4965	7.5	1%	Apr 12	IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 7.0.0; 7.0.1; 7.0.2
CVE-2026-4051	7.2	0%	May 26	IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution Affected: 7.0.3 through Interim Fix 021; 7.1.0 through Interim Fix 009; 7.2.0 through Interim Fix 001
CVE-2026-3603	7.1	0%	May 26	IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack Affected: 7.0.3 Interim Fix 001 through Interim Fix 021; 7.1.0 Interim Fix 001 through Interim Fix 009; 7.2.0 and 7.2.0 Interim Fix 001
CVE-2021-20502	7.1	2%	Mar 30	IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0
CVE-2021-20371	6.5	1%	Jun 2	IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser Affected: 7.0; 7.0.1; 7.0.2
CVE-2020-4732	6.5	1%	Jun 2	IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions Affected: 7.0; 7.0.1; 7.0.2
CVE-2022-34355	5.5	0%	Oct 6	IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that could be used in… Affected: 7.0; 7.0.1; 7.0.2
CVE-2025-36033	5.4	0%	Feb 3	IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting Affected: 7.0.3; 7.0.3; 7.0.3; 7.0.3; 7.0.3; 7.0.3; +17 more
CVE-2021-29670	5.4	0%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-29668	5.4	0%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20348	5.4	1%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF) Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20347	5.4	1%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF) Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20346	5.4	1%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF) Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20345	5.4	1%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF) Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20343	5.4	1%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF) Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20338	5.4	0%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2020-5030	5.4	0%	Jun 2	IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2020-4977	5.4	0%	Jun 2	IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20519	5.4	1%	Apr 12	IBM Jazz Team Server products are vulnerable to cross-site scripting Affected: 7.0.0; 7.0.1; 7.0.2
CVE-2020-4920	5.4	1%	Apr 12	IBM Jazz Team Server products are vulnerable to stored cross-site scripting Affected: 7.0.0; 7.0.1; 7.0.2
CVE-2021-20520	5.4	1%	Mar 30	IBM Jazz Foundation Products are vulnerable to cross-site scripting Affected: 7.0
CVE-2021-20518	5.4	1%	Mar 30	IBM Jazz Foundation Products are vulnerable to cross-site scripting Affected: 7.0
CVE-2021-20506	5.4	1%	Mar 30	IBM Jazz Foundation Products are vulnerable to cross-site scripting Affected: 7.0
CVE-2021-20504	5.4	1%	Mar 30	IBM Jazz Foundation Products are vulnerable to cross-site scripting Affected: 7.0
CVE-2021-20503	5.4	1%	Mar 30	IBM Jazz Foundation Products are vulnerable to cross-site scripting Affected: 7.0
CVE-2021-20447	5.4	1%	Mar 30	IBM Jazz Foundation Products are vulnerable to cross-site scripting Affected: 7.0
CVE-2021-20352	5.4	1%	Mar 30	IBM Jazz Foundation Products are vulnerable to cross-site scripting Affected: 7.0
CVE-2021-20351	5.4	1%	Mar 4	IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20350	5.4	1%	Mar 4	IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20340	5.4	1%	Mar 4	IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2020-4975	5.4	1%	Mar 4	IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2020-4866	5.4	1%	Mar 4	IBM Engineering products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2020-4863	5.4	1%	Mar 4	IBM Engineering products are vulnerable to stored cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2020-4857	5.4	1%	Mar 4	IBM Engineering products are vulnerable to stored cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2020-4856	5.4	1%	Mar 4	IBM Engineering products are vulnerable to stored cross-site scripting Affected: 7.0; 7.0.1; 7.0.2
CVE-2021-20357	5.4	1%	Jan 27	IBM Jazz Foundation products is vulnerable to cross-site scripting Affected: 7.0
CVE-2020-4865	5.4	1%	Jan 27	IBM Jazz Foundation products is vulnerable to cross-site scripting Affected: 7.0
CVE-2020-4855	5.4	1%	Jan 27	IBM Jazz Foundation products is vulnerable to cross-site scripting Affected: 7.0
CVE-2020-4547	5.4	1%	Jan 27	IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim Affected: 7.0
CVE-2020-4524	5.4	1%	Jan 27	IBM Jazz Foundation products is vulnerable to cross-site scripting Affected: 7.0
CVE-2020-4733	5.4	1%	Jan 8	IBM Jazz Foundation products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1
CVE-2020-4697	5.4	1%	Jan 8	IBM Jazz Foundation products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1
CVE-2020-4691	5.4	1%	Jan 8	IBM Jazz Foundation Products are vulnerable to cross-site scripting Affected: 7.0; 7.0.1
CVE-2020-4964	4.3	1%	Apr 12	IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to… Affected: 7.0.0; 7.0.1; 7.0.2
CVE-2020-4544	4.3	1%	Jan 8	IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser Affected: 7.0; 7.0.1
CVE-2020-4487	4.3	1%	Jan 8	IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser Affected: 7.0; 7.0.1