Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Bouncy Castle for Java

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Bouncy Castle for Java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referentia...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.3.25 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.2.31 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

CVE-2026-19651

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

Security Bulletin: IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability. Vulnerability Details CVEID:CVE-2026-11710 DESCRIPTION: IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-19625 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...

CVE-2026-19625

CVE-2026-19625 is a cross-tenant authentication bypass in the OIDC extension of IBM Enterprise Build of Quarkus . When an optional token-introspection cache is enabled, a valid token issued by one OIDC provider tenant can be used to access endpoints secured by a different tenant, because the shar...

CVE-2026-19651 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

CVE-2026-19651

CVE-2026-19651 affects the quarkus-spring-web extension in IBM Enterprise Build of Quarkus versions 3.27.1–3.27.5 and 3.33.1–3.33.3 . The root cause is that the system incorrectly reads the URL query string as a request header, resulting in incorrect mapping of values to untrusted query string in...

Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for August 2026

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the SD-WAN component with a Service Pack update. The publication of this security bulletin represents a change in our communication process, not an increase in security vulnerabilities. IBM SevOne...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.324 Vulnerability Details CVEID:CVE-2025-11468 DESCRIPTION: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in recent security patch releases. Vulnerability Details CVEID:CVE-2026-55654 DESCRIPTION: A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI Generic Securit...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.5.19 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.7.43 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

Security Bulletin: IBM SPSS Modeler is affected by an Eclipse Jetty vulnerability that may allow authentication bypass.

Summary IBM SPSS Modeler is affected by an Eclipse Jetty vulnerability that may allow authentication bypass. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in Bouncy Castle for Java

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in Bouncy Castle for Java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-12185 DESCRIPTION: In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

Summary IBM Db2 is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about multiple security vulnerabilities affecting IBM Db2 has been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

CVE-2026-71375 XXE Vulnerability in Cosminexus Component Container

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses ITOM Rel 3.0.0: idna-3.11-py3-none-any.whl which are vulnerable to CVE-2026-45409. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Names ...

Security Bulletin: IBM WebSphere Application Server is affected by multiple vulnerabilities (CVE-2026-11712, CVE-2026-11595, CVE-2026-11708)

Summary IBM WebSphere Application Server is affected by cross-sight scripting and path traversal vulnerabilities. Vulnerability Details CVEID:CVE-2026-11595 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the...