Tibco vulnerabilities (CVEs)

230 CVEs matched to Tibco by name in NVD, 2 on CISA's Known Exploited list.

Back to the Tibco profile · Alternatives to Tibco · CVE RSS feed

Exploitation riskConfirmed exploited

230 of 230 CVEs assessed

confirmed exploited

past CISA deadline

EPSS ≥ 10%

>99%

highest single CVE

27 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 1 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 1 EPSS observation per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2018-18809 ↗⚠ exploitedoverdueEPSS 79%LEV ≥>99%Confirmed exploited
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Libra…
CVE-2018-5430 ↗⚠ exploitedoverdueEPSS 48%LEV ≥>99%Confirmed exploited
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMat…
↗

Recent changes

last 90 days

CVE-2021-35496 is now estimated at a 33% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-10-20 · NVD ↗
CVE-2019-8986 is now estimated at a 62% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-10-20 · NVD ↗
CVE-2020-9414 is now estimated at a 73% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-10-20 · NVD ↗
CVE-2021-28822 is now estimated at a 16% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-10-20 · NVD ↗
CVE-2022-22770 is now estimated at a 48% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-10-20 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Unscored	Total
2026	1	0	0	0	1	2
2025	0	0	0	0	1	1
2024	0	2	2	0	2	6
2023	2	9	3	0	0	14
2022	7	18	8	0	0	33
2021	7	21	3	0	0	31
2020	3	5	7	0	0	15
2019	6	14	15	0	0	35
2018	3	12	9	0	0	24
2017	1	3	4	0	0	8
2016	0	1	0	0	0	1
2015	0	2	5	0	0	7
2014	0	4	5	0	0	9
2013	0	0	4	0	0	4
2012	0	1	4	0	0	5
2011	0

On CISA's Known Exploited Vulnerabilities list

2 of 230 matched CVEs are listed. 2 are past the remediation due date CISA set.

Most recent additions

CVE-2018-18809 added 2022-12-29
CVE-2018-5430 added 2022-12-29

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2018-18809	79%	>99%
CVE-2018-5430	48%	99%
CVE-2009-1291	6.4%	94%
CVE-2007-5658	6.4%	94%
CVE-2006-2830	6.0%	93%
CVE-2007-5655	5.5%	93%
CVE-2007-5657	5.5%	93%
CVE-2007-5656	5.4%	93%
CVE-2020-9410	5.4%	93%
CVE-2008-1704	5.4%	93%

Known CVEs (230)1 new

RSS ⇢

CVE-2026-4034 ↗new2026
Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console.
CVE-2026-3207 ↗CRITICAL 9.82026
Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.
↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Tibco by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-10-20.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.