Security Bulletin: IBM Storage Protect for Space Management is vulnerable to stored cross-site scripting due to Angular (CVE-2025-66412)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A stored cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to bypass Angular's built-in security sanitization and execute malicious scripts...

Security Bulletin: IBM Storage Protect for Space Management is affected by weaker than expected security controls in IBM WebSphere Application Server Liberty (CVE-2025-14923)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in the Liberty Security Utility could result in weaker than expected security controls during security administration. IBM Storage Protect for Spa...

Preserving Restored InterSystems IRIS Data Before Removing a Storage System

Article Applicability This article expands on the following note from Epic EHR System Protection Restoring from Storage Snapshot in the Veeam Backup & Replication User Guide: Before you start the restore wizard, create an auxiliary host for the LUN mount in the storage system interface, using any...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

EUVD-2026-45957

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerabilities due to Golang library related to ObjectAgent(CVE-2026-39824).

Summary Golang library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang is affected by multiple vulnerabilities that may cause data integrity issues, or memory handling problems when processing specially crafted input. This bulletin identifies the steps to address...

Security Bulletin: IBM Storage Protect Server is affected by multiple vulnerability in the netty-codec-http library that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests(CVE-2026-42581, CVE-2026-42584).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. Netty is vulnerable to multiple vulnerability that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests. This may lead to inconsistent request parsing and...

Security Bulletin: IBM Storage Protect Server is susceptible to a vulnerability due to Golang net library (CVE-22026-33814)

Summary Golang net library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang net is affected by vulnerability that may allow prototype pollution, allowing attackers to manipulate object prototype attributes through vulnerable merge and object conversion APIs...

Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server.

Summary IBM Storage Protect Server, which uses IBM Db2, may be affected by multiple vulnerabilities that could result in denial of service or the loss of confidentiality, integrity. These vulnerabilities include CVE-2025-36122, CVE-2025-14688, CVE-2025-67735, CVE-2025-68161, CVE-2025-12183,...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse Jersey-client library that could cause critical SSL/TLS security configurations issues (CVE-2025-12383).

Summary IBM Storage Protect Server uses the Eclipse Jersey-client library in certain components. A vulnerability in Jersey could cause critical SSL/TLS security configurations issues, which may lead to unauthorized trust of insecure or malicious servers, potentially compromising the confidentiali...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow an authenticated attacker to gain unauthorized access to protected information. (CVE-2025-14915, CWE-200)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow an authenticated attacker to gain unauthorized access to protected information or weaken security controls under specific conditions, that could...

Security Bulletin:IBM Storage Protect Operations Center is affected by a security configuration vulnerability(CVE-2025-14923)

Summary BM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow a security configuration attack under specific conditions. Vulnerability Details CVEID:CVE-2025-14923 DESCRIPTION: IBM WebSphere Application Serv...

Security Bulletin:IBM Storage Protect Operations Center is affected by a hardcoded protection mechanism vulnerability(CVE-2025-14917, CWE-1393).

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow security configuration attack caused by use of hardcoded protection mechanism for LTPA keys, that could impact the security of the affected...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow inadequate validation and processing of maliciously crafted input. (CVE-2026-4410, CWE-400)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow inadequate validation and processing of maliciously crafted input during request handling operations, that could impact the security of the...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow an attacker to trigger denial-of-service conditions. (CVE-2026-5516, CWE-362)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow an attacker to trigger denial-of-service conditions, unexpected behavior, or excessive resource consumption, that could impact the security of t...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to execute arbitrary JavaScript by exploiting insufficient sanitization of href and...