Security Bulletin: IBM watsonx.data integration has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in IBM watsonx.data integration. Vulnerability Details CVEID:CVE-2025-66506 DESCRIPTION: Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.3,...

CVE-2024-29640

creationtimestamp| type| source ---|---|--- 2026-07-07 18:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3azokbve2h...

CVE-2021-21638

creationtimestamp| type| source ---|---|--- 2026-07-07 18:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq3735hw5v24...

CVE-2026-13019

creationtimestamp| type| source ---|---|--- 2026-07-07 17:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq35do63e62b 2026-07-07 19:48:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3er3vied2z 2026-07-08 12:14:06+00:00| seen|...

CVE-2011-10043

creationtimestamp| type| source ---|---|--- 2026-07-07 17:34:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq35a4wvad2x 2026-07-07 19:38:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3e7727ll2z 2026-07-08 11:00:04+00:00| seen|...

CVE-2026-14904

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

CVE-2026-21379

creationtimestamp| type| source ---|---|--- 2026-07-07 16:45:16+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-9...

CVE-2026-59709

creationtimestamp| type| source ---|---|--- 2026-07-07 16:23:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2zc75tn32b...

CVE-2026-12948

creationtimestamp| type| source ---|---|--- 2026-07-07 16:18:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yzanqva24...

CVE-2026-53479

creationtimestamp| type| source ---|---|--- 2026-07-07 16:08:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yhdqmmp27 2026-07-08 09:00:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq4qyhbjfr2v...

a7p (>=1.0.0b1, <=1.0.1rc1), airbyte-source-google-ads (>=3.3.2, <=3.7.10) +23 more potentially affected by CVE-2026-0994 via protobuf (4.25.2)

protobuf PYPI version 4.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - a7p =1.0.0b1, =3.3.2, =1.0.6, =0.1.1, =1.0.8, =0.1.13, =1.20.0, =0.0.2, =0.0.1, =1.3.7 and more Source cves: CVE-2026-0994 Source advisory:...

PYSEC-2026-2001 uv allows ZIP payload obfuscation through parsing differentials

Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP...

uv allows ZIP payload obfuscation through parsing differentials

ImpactIn versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers:1. An attacker could contrive a ZIP...

Bugsink path traversal via event_id in ingestion

SummaryIn affected versions, ingestion paths construct file locations directly from untrusted eventid input without validation. A specially crafted eventid can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.Submitting such...

PYSEC-2026-2028 Vyper's `slice()` may elide side-effects when output length is 0

Impact the slice builtin can elide side effects when the output length is 0, and the source bytestring is a builtin msg.data or .code. the reason is that for these source locations, the check that length = 1 is skipped:...

CVE-2026-6101

creationtimestamp| type| source ---|---|--- 2026-07-07 15:59:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2xwpoa7p2e 2026-07-08 00:00:23+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq3ssu7ort26...

CVE-2026-14940

creationtimestamp| type| source ---|---|--- 2026-07-07 15:52:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2xjzmutw2o...

CVE-2020-21394

creationtimestamp| type| source ---|---|--- 2026-07-07 15:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq2wovzeyo2g...

CVE-2026-13696

creationtimestamp| type| source ---|---|--- 2026-07-07 15:27:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2w5cnpd52v...

GO-2026-5903 Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon...