CVE-2026-9764

IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...

Security Bulletin: IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution (CVE-2026-9764)

Summary IBM Bob could allow a remote attacker to execute arbitrary code when a user opens an untrusted repository in Bob Shell. Due to insufficient validation of workspace-provided MCP server configurations, MCP servers defined within the repository could be automatically executed without explici...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.1.0 Vulnerability Details CVEID:CVE-2026-12537 DESCRIPTION: Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.2...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.0.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779. CWE:CWE-770: Allocation of Resources Without Limi...

Security Bulletin: IBM Bob Premium Package for i is affected by multiple vulnerabilities

Summary There are multiple vulnerabilities in IBM Bob Premium Package for i. fast-uri can fail to canonicalize Unicode hostnames CVE-2026-13676. Hono Web Application framework can allow untrusted className values CVE-2026-59895, does not isolate context vales CVE-2026-59896, can drop distinct...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.0 Vulnerability Details CVEID:CVE-2026-41676 DESCRIPTION: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive and PkeyCtxRef::derive sets len = buf.len and passes it...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 1.0.2 Vulnerability Details CVEID:CVE-2026-39407 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static...