Security Bulletin: Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

Summary A security vulnerability was identified in the code security scanner where the DANGEROUSIMPORTS blocklist incompletely addressed network-based code execution risks. While subprocess module imports were correctly blocked, socket and urllib standard library modules were omitted from the...

CVE-2026-12758 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers...

CVE-2026-12758

IBM Cloud Pak for Business Automation is vulnerable to an authorization bypass caused by improper validation of HTTP headers. A remote attacker with low privileges can exploit this to invoke restricted endpoints, resulting in low confidentiality and low integrity impact (CVSS 3.1 score 5.4, MEDIU...

CVE-2026-12758 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers...

CVE-2026-12759 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption...

CVE-2026-12759

CVE-2026-12759 affects IBM Cloud Pak for Business Automation (specifically IBM Business Automation Workflow ), where an authenticated user can trigger uncontrolled resource consumption leading to a denial of service (CWE-400). The vulnerability is rated CVSS 6.5 (Medium) with network attack vecto...

CVE-2026-12759 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption...

CVE-2026-54628

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

CVE-2026-17467

IBM Cloud Pak for Data System Yosemite 1.0 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols...

CVE-2026-16673

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property...

CVE-2026-16338

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-16432

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-24842 DESCRIPTION: node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses...

CVE-2026-54628 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

CVE-2026-54628 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

EUVD-2026-77812

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

CVE-2026-54628

Anyquery is a Go-based SQL query engine built on SQLite. In server mode (anyquery server), the unauthenticated MySQL-compatible port allows remote attackers to create virtual tables using modules such as json_reader and log_reader, which internally use go-getter to fetch arbitrary URLs. Because o...

CVE-2026-54628 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

CVE-2026-73497 MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. From 0.17.0 until 0.22.0, validateurlforssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built...

CVE-2026-73497 MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. From 0.17.0 until 0.22.0, validateurlforssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built...