CVE-2026-104721

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-104721 Logback: Incomplete protection against CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-104721

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-104721

A path-traversal vulnerability exists in the logback-classic module for Java (versions 0.9.14 through 1.6.4 ). The flaw is caused by an unsanitized Mapped Diagnostic Context (MDC) discriminator value flowing into a nested FileAppender path. An attacker capable of influencing this MDC value—for ex...

EUVD-2026-91633

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

Linux Distros Unpatched Vulnerability : CVE-2026-104721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path- traversal vulnerability. More specifically, an MDC-based...

CVE-2026-104721: Improper Limitation of a Pathname to a Restricted Directory

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

PT-2026-104330

Name of the Vulnerable Software and Affected Versions Logback-classic versions 0.9.14 through 1.6.4 Description A path-traversal issue exists in the logback-classic module. An MDC-based discriminator value is passed unsanitized into a nested FileAppender path. An attacker who can influence this M...

OESA-2026-4014 logback security update

Logback is intended as a successor to the popular log4j project. Security Fixes: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested...

UBUNTU-CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880: Improper Limitation of a Pathname to a Restricted Directory

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-10532: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer...

CVE-2026-9828: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer c...

Security Bulletin: Vulnerability in QOS.ch Sarl Logback affects watsonx.data

Summary A serialization vulnerability in logback receiver component part of QOS.ch Sarl Logback allows an attacker to mount a Denial-Of-Service attack on watsonx.data by sending poisoned data. This can affect watsonx.data. Vulnerability Details CVEID:CVE-2023-6378 DESCRIPTION: QOS.ch Sarl Logback...

Security Bulletin: Vulnerability in QOS.ch Sarl Logback affects watsonx.data

Summary A serialization vulnerability in logback receiver component part of QOS.ch Sarl Logback allows an attacker to mount a Denial-Of-Service attack to watsonx.data by sending poisoned data. Vulnerability Details CVEID:CVE-2023-6481 DESCRIPTION: QOS.ch Sarl Logback is vulnerable to a denial of...

Security Bulletin: Multiple Vulnerabilities in IBM Operations Analytics Predictive Insights.

Summary Multiple vulnerabilities were addressed in IBM Operations Analytics Predictive Insights 1.3.6 iFix 8 Vulnerability Details CVEID:CVE-2022-46337 DESCRIPTION: Apache Derby could allow a remote attacker to bypass security restrictions, caused by a LDAP injection vulnerability in authenticato...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. QOS.ch Sarl Logback is vulnerable to a denial of service CVE-2023-6481, CVE-2023-6378. The Bouncy Castle Crypto Package For Java...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2024.

Summary Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF030 and 23.0.2-IF002. Vulnerability Details CVEID:CVE-2023-2976 DESCRIPTION: Google Guava could allow a local authenticated attacker to obtain sensitive information, caused by a flaw with...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in QOS.ch Sarl Logback

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of QOS.ch Sarl Logback Vulnerability Details CVEID:CVE-2023-6481 DESCRIPTION: QOS.ch Sarl Logback is vulnerable to a denial of service, caused by a serialization flaw in the logback receiver component...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to QOS.ch Sarl Logback denial of service vulnerability ( CVE-2023-6378)

Summary Potential QOS.ch Sarl Logback denial of service vulnerability CVE-2023-6378 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-6378...