Security Bulletin: Security vulnerability in IBM Datacap

Summary This vulnerability, CVE-2026-49844, is addressed in IBM Datacap version 9.1.9 Interim Fix 009. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not...

EUVD-2026-88465

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

SilkETW

SilkETW & SilkService SilkETW & SilkService are flexible C wrappers for ETW, they are meant to abstract away the complexities of ETW and give people a simple interface to perform research and introspection. While both projects have obvious defensive and offensive applications they should primaril...

CVE-2026-81320: Insertion of Sensitive Information into Log File

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CLEANSTART-2026-JY79008 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Multiple security vulnerabilities affect the apache-hive package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

SUSE CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

EUVD-2026-70737

node-csv: Prototype replacement still reachable via columns path...

SWC HTML minifier may allow script element breakout when minifying embedded JSON

Impact @swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal sequence, the generated HTML...

BIT-JENKINS-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

PT-2026-88172

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

Improper Certificate Validation

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation in the BalancedPool class, which deep-clones its connect and tls options with JSON.parseJSON.stringify... and thereby...

CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961

undici's BalancedPool constructor deep-clones its options object via JSON serialization, which silently drops function-valued TLS options such as a custom checkServerIdentity callback or a custom connector in the connect option. When these are lost, a peer presenting a certificate that Node's def...

CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Improper Encoding or Escaping of Output due to Apache Log4j (CVE-2026-49844)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Improper Encoding or Escaping of Output due to Apache Log4j. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Management Interoperability Services(CMIS) 3.0.7-IF15

Summary IBM Content Management Interoperability ServicesCMIS 3.0.7-IF15 addresses CVEs related to log4j, neethi and cxf in v3.0.7-IF15 Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j...

PT-2026-85804

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-84961: Improper Certificate Validation

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...