Security Bulletin: Vulnerabilities in spring-context, logback-core and Another JSON Schema Validator might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in spring-context, logback-core and Another JSON Schema Validator. Vulnerabilities include VMware Tanzu Spring Framework could provide weaker than expected security, caused by a flaw related to disallowedFields...

Security Bulletin: User Entity Behavior Analytics App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. User Entity Behavior Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2025-11226 DESCRIPTION:...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in QOS.CH logback-core (CVE-2026-13006)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in QOS.CH logback-core. Logback-core is used in our Speech microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-13006...

Security Bulletin: Security vulnerabilities in Logback affect IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-10532 , CVE-2026-9828)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core module...

Atlassian Confluence 6.6.x < 9.2.24 / 9.3.x < 10.2.17 / 11.0.0 (CONFSERVER-104474)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104474 advisory. - ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications,...

Security Bulletin: Multiple vulnerabilties in DevOps Test Hub

Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 11.0.9 Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all...

RHLW-2026-730F8211B080B586 Lightwell Security Advisory: logback-core 1.5.18.rhlw-00003

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.18.rhlw-00003 with a backported security fix. CVE-2026-1225: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes...

RHLW-2026-A08954EF69E23D40 Lightwell Security Advisory: logback-core 1.2.11.rhlw-00001

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.11.rhlw-00001 with backported fixes for CVE-2023-6378, CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, CVE-2026-10532, CVE-2026-1225, and CVE-2026-9828. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12798: ACE...

Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albei...

RHLW-2026-055D7BDE52D9946F Lightwell Security Advisory: logback-core 1.2.12.rhlw-00005

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.12.rhlw-00005 with backported fixes for CVE-2023-6378 and CVE-2024-12801. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12801: Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14...

Security Bulletin:Deserialization of Untrusted Data Vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream) - Object Injection Possible

Summary Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or...

Security Bulletin:Deserialization of Untrusted Data Vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream)

Summary Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or...

Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution

Summary Due to use of QOS.CH logback IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution CVE-2024-12801, CVE-2024-12798. Those issues were addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Reque...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc (crlsa-2019_2720)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20192720 advisory. jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution CVE-2019-12384 Tenable has extracted the...

RHLW-2026-07E5370D09E5A6F8 Lightwell Security Advisory: logback-core 1.5.9.rhlw-00031

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880. CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0...

ROOT-APP-MAVEN-CVE-2026-1225 CVE-2026-1225 in ch.qos.logback:logback-core - Patched by Root

Root has patched CVE-2026-1225 in the ch.qos.logback:logback-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2021-42550 CVE-2021-42550 in ch.qos.logback:logback-core - Patched by Root

Root has patched CVE-2021-42550 in the ch.qos.logback:logback-core package for Root:Maven. Multiple fixed versions available...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091415)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091415 advisory. FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorph...

RHLW-2026-666A4E7D1066F856 Lightwell Security Advisory: logback-core 1.5.16.rhlw-00002

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.16.rhlw-00002 with a backported security fix. CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.5.16 from Maven Central...

Security Bulletin: A vulnerability in logback-core-1.3.14.jar found in IBM Devops Code ClearCase

Summary A vulnerability in logback-core-1.3.14.jar found in IBM Devops Code ClearCase CVE-2026-9828 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Obje...