Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a secon...

CVE-2026-77522

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback,...

ROS-20260921-73-0112

The vulnerability of the Verify function in the Go programming language is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

EulerOS Virtualization 2.10.0 : python-requests (EulerOS-SA-2026-3884)

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3717)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check

A flaw was found in golang.org/x/crypto/ssh. The Verify method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially...

CVE-2026-12358

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-11934

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input...

CVE-2026-11928

IBM Verify Identity Access is vulnerable to a buffer overflow attack...

CVE-2026-11927

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11929

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-12101

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests...

CVE-2026-11926

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-11921

IBM Verify Identity Access containers may not apply management password change operations correctly...

CVE-2026-11921 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access containers may not apply management password change operations correctly...

EUVD-2026-78897

IBM Verify Identity Access containers may not apply management password change operations correctly...

CVE-2026-11921 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access containers may not apply management password change operations correctly...

CVE-2026-11921

IBM Verify Identity Access containers may not correctly apply management password change operations, leading to insufficiently protected credentials (CWE-522). This issue affects IBM Verify Identity Access (v11.0.0 - 11.0.3 IF1), IBM Security Verify Access (v10.0.0 - 10.0.9.2 IF1), and their resp...

CVE-2026-11926 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-11926

The IBM Verify Identity Access software is vulnerable to a denial of service (DoS) attack. This is caused by insufficient validation of incoming request resources , which could allow a remote attacker to trigger uncontrolled resource consumption. While the vulnerability is confirmed, the provided...