Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in ws

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in ws. CCVE-2026-45736 The vulnerability have been addressed. Vulnerability Details CVEID:CVE-2026-45736 DESCRIPTION: ws is an open source WebSocket client and server for Node.js. Pri...

Fedora 43 : python-jupytext (2026-31e6b85f4e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-31e6b85f4e advisory. See https://github.com/jupytext/jupytext/releases/tag/v1.19.4 for changes in version 1.19.4. Notable, this update fixes CVE-2026-45736 and...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses ws-8.17.1 in inspections application which is vulnerable to CVE-2026-45736

Summary IBM Maximo Application Suite - Manage Component uses ws-8.17.1 in inspections application which is vulnerable to CVE-2026-45736. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-45736 DESCRIPTION: ws is an open source...

CVE-2026-45736 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, opensearch-dashboards, vitess, code-server, langfuse, py3-jupyterlab, argo-workflows, kubeflow-katib...

-fides-amor-et-lux (=1.0.0), -price-checker (>=1.0.0 <=1.0.5) +35597 more potentially affected by CVE-2026-45736 via ws (>=8.0.0 <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit =0.1.0 - 0g-zksettlement-client =1.0.0 and more Source cves: CVE-2026-45736 Source advisory: OSV:GHSA-58QX-3VCG-4XPX...

ws: Uninitialized memory disclosure

Impact The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. Proof of concept js import deepStrictEqual from 'node:assert'; import WebSocket, WebSocketServer from 'ws'; const wss = new WebSocketServer port: 0,...

Linux Distros Unpatched Vulnerability : CVE-2026-45736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close implementation is vulnerable to uninitialized memory disclosu...

-fides-amor-et-lux (=1.0.0), -price-checker (>=1.0.0 <=1.0.5) +35597 more potentially affected by CVE-2026-45736 via ws (>=8.0.0 <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit =0.1.0 - 0g-zksettlement-client =1.0.0 and more Source cves: CVE-2026-45736 Source advisory: SNYK:JS-WS-16722635...

org.webjars.npm:autobahn (=0.11.2), org.webjars.npm:blockly (>=9.3.2 <=10.4.1) +17 more potentially affected by CVE-2026-45736 via org.webjars.npm:ws (>=8.11.0 <=8.2.3)

org.webjars.npm:ws MAVEN version =8.11.0, =9.3.2, =6.2.1, =6.2.1, =0.19.11, =0.2.11, =21.1.1, =22.1.0 - org.webjars.npm:nestjsplatform-socket.io =9.0.0-next.2 and more Source cves: CVE-2026-45736 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16722636...