Security Bulletin: Multiple vulnerabilities found in logback-core jar which is part of IBM webMethods API Management

Summary Multiple vulnerabilities found in logback-core jar which is part of IBM webMethods API Management have been addressed Vulnerability Details CVEID:CVE-2026-1225 DESCRIPTION: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java...

CVE-2026-83557: Deserialization of Untrusted Data

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

PT-2026-84291

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.core:jackson-databind versions 2.11.0 through 2.18.9 com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5 com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1...

Chronicle Wire 2026.8 Class Instantiation

Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation during untyped deserialization. Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation durin...

Exploit for Improper Input Validation in Microsoft

CVE-2026-63520 Sharepoint unsafe type RCE + CVE-2026-55040 cha...

Security Bulletin: Vulnerability in Java affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Java has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

CVE-2026-79784

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

PT-2026-81373

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate class in vocos/pretrained.py takes the class path value from the configuration, splits it into a module and an attribute, imports the module with import , resolves the attribute with...

BIT-JENKINS-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

BIT-AIRFLOW-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

PT-2026-73237

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize value without the check forbidden xcom keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow...

PT-2026-73346

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

GHSA-Q4C3-7575-55J2 Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

PYSEC-2026-3992

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

PYSEC-2026-3992

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

CVE-2026-70430

A flaw was found in Jenkins. This vulnerability allows an attacker with Overall/Manage permission to instantiate arbitrary types of objects within the project naming strategy configuration. This includes types typically reserved for administrators, potentially leading to unauthorized configuratio...

CVE-2026-59242

Apache Airflow versions prior to 3.3.1 are vulnerable to a deserialization of untrusted data (CWE-502) flaw. The GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint passes string-literal payloads through BaseXCom.deserialize_value without the _check_forbidden_xcom_keys guard. This allow...

CVE-2026-59242

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...