Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI (CVE-2026-59879, CVE-2026-59880)

Summary IBM Tivoli Netcool/OMNIbus WebGUI includes the Immutable.js library for persistent immutable data structures used in the client-side UI. Vulnerabilities have been identified in this library that could affect the product. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for July 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF001 Vulnerability Details CVEID:CVE-2026-41602 DESCRIPTION: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. User...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses pillow-12.2.0-cp314-cp314-manylinux227x8664.manylinux228x8664.whl, immutable-4.3.8.tgz, urllib3-2.6.3-py3-none-any.whl, form-data-4.0.5.tgz, pyjwt-2.12.1-py3-none-any.whl which are vulnerable to CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380,...

CVE-2026-59880 vulnerabilities

Vulnerabilities for packages: rancher-api-ui, vitess, argo-workflows, nextcloud-server...

CVE-2026-59880 vulnerabilities

Vulnerabilities for packages: authentik-fips, gitlab-rails-ce-fips, keep-fips, arangodb, nextcloud-server, rancher-api-ui, authentik, keep, gitlab-rails-ce, argo-workflows, vitess...

-graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2), 01-test-button (>=1.0.0, <=1.0.2) +10998 more potentially affected by CVE-2026-59880 via immutable (>=3.0.1, <=3.8.3)

immutable NPM version =3.0.1, =2.0.1, =1.0.0, =0.0.2, =0.2.0, =2.0.0-rc3, =1.0.0, =1.0.0, =0.1.0, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2026-59880 Source advisory: GHSA-XVCM-6775-5M9R...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +655 more potentially affected by CVE-2026-59880 via immutable (>=4.0.0-rc.1, <=4.3.8)

immutable NPM version =4.0.0-rc.1, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59880 Source advisory: GHSA-XVCM-6775-5M9R...

-graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2), 01-test-button (>=1.0.0, <=1.0.2) +10998 more potentially affected by CVE-2026-59880 via immutable (>=3.0.1, <=3.8.3)

immutable NPM version =3.0.1, =2.0.1, =1.0.0, =0.0.2, =0.2.0, =2.0.0-rc3, =1.0.0, =1.0.0, =0.1.0, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2026-59880 Source advisory: OSV:GHSA-XVCM-6775-5M9R...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +655 more potentially affected by CVE-2026-59880 via immutable (>=4.0.0-rc.1, <=4.3.8)

immutable NPM version =4.0.0-rc.1, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59880 Source advisory: OSV:GHSA-XVCM-6775-5M9R...

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +138 more potentially affected by CVE-2026-59880 via immutable (>=5.0.0-beta.2, <=5.1.6)

immutable NPM version =5.0.0-beta.2, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =9.1.1-ruixiang.1, =0.1.0, =1.0.6 and more Source cves: CVE-2026-59880 Source advisory: GHSA-XVCM-6775-5M9R...

org.webjars.npm:sass (>=1.49.7, <=1.80.3) potentially affected by CVE-2026-59880 via org.webjars.npm:immutable (5.0.0-beta.4)

org.webjars.npm:immutable MAVEN version 5.0.0-beta.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:immutable and may be impacted: - org.webjars.npm:sass =1.49.7, =1.80.3 Source cves: CVE-2026-59880 Source advisory:...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +655 more potentially affected by CVE-2026-59880 via immutable (>=4.0.0-rc.1, <=4.3.8)

immutable NPM version =4.0.0-rc.1, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59880 Source advisory: SNYK:JS-IMMUTABLE-17900558...

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +138 more potentially affected by CVE-2026-59880 via immutable (>=5.0.0-beta.2, <=5.1.6)

immutable NPM version =5.0.0-beta.2, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =9.1.1-ruixiang.1, =0.1.0, =1.0.6 and more Source cves: CVE-2026-59880 Source advisory: SNYK:JS-IMMUTABLE-17900558...

CVE-2026-59880

creationtimestamp| type| source ---|---|--- 2026-07-08 18:17:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5q4e2tph25 2026-07-11 08:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqeb3l7qsu26 2026-07-21 20:35:16+00:00| published-proof-of-concept|...

UBUNTU-CVE-2026-59880

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such a...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +655 more potentially affected by CVE-2026-59880 via immutable (>=4.0.0-rc.1, <=4.3.8)

immutable NPM version =4.0.0-rc.1, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59880 Source advisory: MEND:CVE-2026-59880...