Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2024-36620, CVE-2025-54410, CVE-2026-92542, CVE-2026-92543.

Summary Multiple vulnerabilities in the Docker/Moby dependency affect IBM Cloud Pak for Data Scheduling Service. The fixes are included in Scheduling Service 1.61.10 for IBM Cloud Pak for Data 5.3.1 and Scheduling Service 2.0.6 for IBM Cloud Pak for Data 5.4.0. Vulnerability Details...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-56851, CVE-2026-56852.

Summary golang.org/x/text is used by the CPD Scheduling Service. CVE-2026-56851, CVE-2026-56852. Vulnerability Details CVEID:CVE-2026-56851 DESCRIPTION: The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. CWE:CWE-787:...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2023-44487.

Summary The CPD Scheduling service uses Go lang, golang.org/x/net and gRPC-Go. CVE-2023-44487. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploit...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-84303 and CVE-2026-84304

Summary gRPC-Go is used by the Scheduling Service. CVE-2026-84303 and CVE-2026-84304. Vulnerability Details CVEID:CVE-2026-84303 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-56855 and CVE-2026-78662.

Summary golang.org/x/crypto is used by the Scheduling Service. CVE-2026-56855 and CVE-2026-78662. Vulnerability Details CVEID:CVE-2026-56855 DESCRIPTION: Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, ...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-84304.

Summary gRPC-Go is used by the Scheduling Service. CVE-2026-84304. Vulnerability Details CVEID:CVE-2026-84304 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulernable to CSRF Attack (CVE-2025-47909)

Summary gorilla/csrf is used by Scheduling Service. A vulnerability in gorilla/csrf is addressed. Vulnerability Details CVEID:CVE-2025-47909 DESCRIPTION: Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks...

EUVD-2021-25378

Malware in sbrugna...

EUVD-2023-31299

Malicious code in bioql PyPI...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.11.0 Vulnerability Details CVEID:CVE-2025-30749 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulernable to CVE-2025-24358

Summary github.com/gorilla/csrf-v1.7.1 is used by the Scheduling Service. Vulnerability Details CVEID:CVE-2025-24358 DESCRIPTION: gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Orig...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulernable to CVE-2025-22870

Summary golang.org/x/net-v0.25.0 and golang.org/x/net-v0.33.0 are used by the Scheduling Service. Vulnerability Details CVEID:CVE-2025-22870 DESCRIPTION: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environmen...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulernable to the Sweet32 attack.

Summary The 3DES cipher was available in some TLS cipher suites. Vulnerability Details CVEID:CVE-2016-2183 DESCRIPTION: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulernable to CVE-2024-45338.

Summary golang.org/x/net-v0.24.0 is used by the CP4D Scheduling Service. CVE-2024-45338. Vulnerability Details CVEID:CVE-2024-45338 DESCRIPTION: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow...

CVE-2023-27545

IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 248947...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.5.1 Vulnerability Details CVEID:CVE-2021-3538 DESCRIPTION: go.uuid could allow a remote attacker to obtain sensitive information, caused by the use of insecure randomness in the g.rand.Read function. By utilize...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.7.1 Vulnerability Details CVEID:CVE-2024-39705 DESCRIPTION: Natural Language Toolkit NLTK could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when an untrusted packages have...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.7.0 Vulnerability Details CVEID:CVE-2024-43380 DESCRIPTION: floraison fugit is vulnerable to a denial of service, caused by improper input validation by the natural parser. By sending a specially crafted request,...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.6.0 Vulnerability Details CVEID:CVE-2022-25857 DESCRIPTION: Java package org.yaml:snakeyam is vulnerable to a denial of service, caused by missing to nested depth limitation for collections. By sending a...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulernable to CVE-2023-45288.

Summary Golang's net/http is used by the CP4D Scheduling Service for http communication. CVE-2023-45288. Vulnerability Details CVEID:CVE-2023-45288 DESCRIPTION: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames...