Security Bulletin: IBM i is Affected By An Improper Management Vulnerability in HTTP Server [CVE-2026-18071]

Summary IBM i is vulnerable to elevated privileges due to improper privilege management CVE-2026-18071 in HTTP Server as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18071 DESCRIPTION: IBM i could allow a local attacker to gain elevated privileges due to...

Exploit for Improper Input Validation in Boa

\ CVE-2009-4496 — Defensive Vulnerability Analysis \ Overv...

Security Bulletin: IBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM [CVE-2026-17078]

Summary IBM i is vulnerable to a denial of service due to resource exhaustion CVE-2026-17078 in Distributed Relational Database Architecture DRDA / Distributed Data Management DDM as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17078 DESCRIPTION: IBM i coul...

Exploit for Heap-based Buffer Overflow in Microsoft

CVE-2026-54984 Windows ICC file parsing out-of-bounds write...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Multiple vulnerabilities are resolved: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518 Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Multiple vulnerabilities are resolved: CVE-2026-59888, CVE-2026-59889 Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Ja...

Security Bulletin: Insufficient Authentication Brute Force Protection on Login Endpoint

Summary A rate limiting capability exists within the product to restrict the number of authentication attempts permitted per IP address per minute against the login endpoint POST /api/v1/login. This control is configurable via the LANGFLOWRATELIMITENABLED environment variable, which defaults to...

GHSA-CRF3-V9RR-V7HJ vulnerabilities

Vulnerabilities for packages: seata...

Security Bulletin: IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP [CVE-2026-17438]

Summary IBM i is vulnerable to obtaining sensitive information or modifying data due to improper privilege management CVE-2026-17438 in Lightweight Directory Access Protocol LDAP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17438 DESCRIPTION: IBM i could...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-17029, CVE-2026-18511, CVE-2026-18068, CVE-2026-18086 in Java Secure Sockets Extension JSSE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17029 DESCRIPTION: IBM i could allow a local attacke...

Security Bulletin: IBM i is Affected By A Prvilege Escalation Vulnerability [CVE-2026-18509]

Summary IBM i is vulnerable to privilege escalation CVE-2026-18509 in Navigator and Debug Service as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18509 DESCRIPTION: IBM i could allow a local authenticated attacker to gain privilege escalation via the...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-16674, CVE-2026-18101, CVE-2026-18715 in WebSphere Application Server Liberty as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18101 DESCRIPTION: IBM i could allow a local attacker to gain...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol

Summary IBM i is vulnerable to multiple vulnerabilites CVE-2026-18077, CVE-2026-16815, CVE-2026-16692 in Simple Mail Transfer Protocol SMTP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18077 DESCRIPTION: IBM i could allow a remote attacker to cause a...

Security Bulletin: IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

Summary IBM i is vunlerable to multiple vulnerabilities CVE-2026-18193, CVE-2026-18249, CVE-2026-17476 in IBM SDK Java Technology Edition and IBM Runtime Environment Java to support the building and running of Java applications as described in the vulnerability details section. Vulnerability...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Network Authentication Service

Summary IBM i is vulnerable to mutiple vulnerabilities CVE-2026-16898, CVE-2026-16896 in Network Authentication Service NAS as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16898 DESCRIPTION: IBM i could allow a local authenticated attacker to change the...

Exploit for CVE-2026-41452

CVE-2026-41452 — Krayin CRM Installer Auth Bypass → Admin Take...

Exploit for CVE-2026-73034

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal...

GHSA-FCMM-42R9-MMMM Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...