EUVD-2026-75765

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-80434 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...

CVE-2026-80424

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected by a path traversal vulnerability (CWE-22) that occurs during archive extraction , allowing a remote authenticated attacker to create arbitrary files. The flaw is rated CVSS 9.1 (Critical) with a scope change, reflecting high integri...

CVE-2026-82092 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-82092

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an absolute-path traversal vulnerability that allows a remote, authenticated attacker to obtain sensitive information. The IBM-assigned CVSS 3.1 score is 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high imp...

PT-2026-89642

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities in various components

Summary IBM Cloud Pak for Data System 1.0 includes several open source and third-party components as part of its software stack. Multiple security vulnerabilities have been identified across various components including PLY, Apache HttpComponents, pyasn1, pip, and Eclipse Jetty. These...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0)

Summary Vulnerabilities exists in IBM Cloud Pak for Data System CPDS 1.0 addressed in 11.3.1.2-IF1 Vulnerability Details CVEID:CVE-2025-71176 DESCRIPTION: pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-user name pattern, which allows local users to cause a denial of...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by HTTP message parser vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Cloud Pak for Data System 1x to provide HTTP client and server functionality. CVE-2026-54399 affects Apache HttpComponents Core's HTTP/1.1 message parser when processing messages with excessive headers or header lengths, allowing remote attackers ...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-27903 DESCRIPTION: minimatch is a minimal matching utility for converti...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by use of a broken cryptographic algorithm vulnerability due to Paramiko

Summary Paramiko is used by IBM Cloud Pak for Data System 1.0 as a Python implementation of the SSH protocol for secure remote connections and file transfers. CVE-2026-44405 affects Paramiko's RSA key handling in rsakey.py, where the SHA-1 algorithm is permitted for cryptographic operations despi...

CVE-2023-33854

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data are affected (versions 4.8, 5.0, 5.1, 5.2, 5.3). The issue allows an authenticated user to bypass client-side validation and manipulate input data via man-in-the-middle techniques. Underlying impact is HIGH for integrity, with ...

EUVD-2025-210299

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation...

EUVD-2024-55643

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to improper allocation of resources...

CVE-2024-54178

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to improper allocation of resources...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 patch 6 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.x) Platform - Multiple Vulnerabilities in IBM Java

Summary IBM Cloud Pak for Data System CPDS 1.x Platform uses IBM Java versions that are affected by multiple critical vulnerabilities disclosed in the Oracle January 2026 CPU advisory. The vulnerabilities impact IBM Java 7.1 prior to 7.1.5.29 and 8.0 prior to 8.0.8.60. These vulnerabilities affec...

Security Bulletin: IBM watsonx.ai on Cloud Pak for Data is vulnerable to python-Python-3.12.0b4 (Publicly disclosed vulnerability found by Mend) due to python pip package ( CVE-2023-5752, PRISMA-2022-0168)

Summary IBM watsonx.ai on Cloud Pak for Data internally uses CVE-2023-5752 Vulnerability Details CVEID:CVE-2023-5752 DESCRIPTION: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary...

CVE-2025-36221

Summary: CVE-2025-36221 affects IBM Cloud Pak for Data System – Cyclops 11.3.0.2 with Interim Fix 002. The root cause is the use of default passwords from the manufacturing process during installation, which could allow an attacker to bypass authentication. Impact (as documented): Authentication ...

CVE-2025-36220 Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.

IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...