CVE-2026-79723: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints...

CVE-2026-81550: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-79724: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

CVE-2026-81554: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-80378: Improper Authorization

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization...

CVE-2026-80424: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction...

CVE-2026-9327: Improper Privilege Management

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

CVE-2026-19646: Undefined Security Weakness

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...

CVE-2026-81213: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

CVE-2026-79725: Improper Access Control

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-78573: Use of Default Credentials

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-81207: Server-Side Request Forgery (SSRF)

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an outbound fetch originating from a shared-infrastructure pod, and the WSDL body is reflected verbatim to the caller. The ds-canvas pod sits ...

CVE-2026-84889: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

CVE-2026-81551: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability...

Security Bulletin: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core

Summary Upgrade to new jsonListener.jar Vulnerability Details CVEID:CVE-2026-13006 DESCRIPTION: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing...

Security Bulletin: IBM Informix HQ is affected by multiple vulnerabilities in third-party libraries.

Summary Multiple security vulnerabilities in third-party and open-source dependencies affect IBM Informix HQ. These flaws include Denial of Service via memory exhaustion or inefficient regular expressions, host parser interpretation conflicts leading to potential SSRF/redirect bypass, cross-site...

Security Bulletin: IBM Informix HQ affected by Vulnerabilities (CVE-2026-6790, CVE-2025-11143, and CVE-2026-2332) in third-party library Jetty.

Summary IBM InformixHQ is affected by several vulnerabilities in Jetty. IBM InformixHQ has been updated to use the latest Jetty release. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request...

Security Bulletin: Vulnerability in jackson-core affects IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is susceptible to a Denial of Service CVE-2026-18401 threat due to the use of jackson-core. jackson-core is used by TS7700 Management Interface to serialize/deserialize JSON data. Vulnerability Details ID:WS-2026-0003 DESCRIPTION: The non-blocking async JS...

Security Bulletin: Vulnerability in js-yaml affects IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is susceptible to a Privilege Escalation / Denial of Service CVE-2026-64718 threat due to the use of js-yaml. js-yaml is part of Node.js, which is used by TS7700 to provide the Management Interface. Vulnerability Details CVEID:CVE-2025-64718 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.18 Vulnerability Details CVEID:CVE-2026-45819 DESCRIPTION: baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process...