Security Bulletin: IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core (CVE-2026-41848)

Summary IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core CVE-2026-41848 Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which i...

Security Bulletin: Vulnerability in @opentelemetry/core affects DB2 Dev Extension (CVE-2026-54285)

Summary Upgraded @opentelemetry/core to 2.8.0. Vulnerability Details CVEID:CVE-2026-54285 DESCRIPTION: opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP header...

Security Bulletin: Vulnerability in Apache Log4j API affects DB2 Dev Extension (CVE-2026-49844)

Summary Upgraded log4j-api to 2.25.5 to remediate CVE-2026-49844 CWE-116: Improper Encoding of non-finite floating-point values in MapMessage JSON serialization — CVSS Base Score 6.3 Medium — PVR0815934. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: brace-expansion-2.1.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary brace-expansion 2.1.1 affected by CVE-2026-13149 — exponential CPU consumption in expand via consecutive non-expanding brace groups, causing event-loop blocking DoS. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service...

Security Bulletin: Vulnerability in Spring Boot affects DB2 Dev Extension (CVE-2026-40992, CVE-2026-41001)

Summary Upgraded spring-boot-autoconfigure to 3.5.15 to remediate CVE-2026-40992 Improper Certificate Validation and CVE-2026-41001 Insecure Temporary File — highest CVSS Base Score 5.3 Medium — PVR0789890. Vulnerability Details CVEID:CVE-2026-40992 DESCRIPTION: Spring Boot's Mail...

Security Bulletin: Vulnerability in brace-expansion affects DB2 Dev Extension (CVE-2026-14257)

Summary Upgraded brace-expansion to 5.0.8 to remediate CVE-2026-14257 CWE-400: Uncontrolled Resource Consumption — memory exhaustion DoS via unbounded result string length in expand — CVSS Base Score 7.5 High — PVR0827522. Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion...

Security Bulletin: Vulnerability in form-data affects DB2 Dev Extension (CVE-2026-12143)

Summary Upgraded form-data to 4.0.6 to remediate CVE-2026-12143 CWE-93: CRLF Injection — CVSS Base Score 7.5 High — PVR0791412. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in Spring Expression (CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 )

Summary IBM Db2 Developer Extension is affected by vulnerability in Spring Expression CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

Security Bulletin: Vulnerability in Apache Tomcat affects DB2 Dev Extension (CVE-2026-59083, CVE-2026-59084)

Summary Upgraded tomcat-embed-core to 10.1.57 to remediate CVE-2026-59083 Security Constraint Bypass via URL hex-encoding and CVE-2026-59084 Insufficient EncryptInterceptor Documentation — CVSS Base Score 9.1 Critical — PVR0818163. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper...

CVE-2026-92784

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515 Vulnerability Details CVEID:CVE-2026-41293 DESCRIPTION: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat:...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in log4j core (CVE-2026-34477, CVE-2026-34478)

Summary IBM Db2 Developer Extension is affected by vulnerability in log4j core CVE-2026-34477, CVE-2026-34478 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificatio...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in axios (CVE-2025-62718)

Summary IBM Db2 Developer Extension is affected by vulnerability in axios CVE-2025-62718 Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization whe...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41284,CVE-2026-42498,CVE-2026-43514,CVE-2026-24880, CVE-2026-34483,CVE-2026-34487,CVE-2026-34500)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-41284,CVE-2026-42498,CVE-2026-43514,CVE-2026-24880, CVE-2026-34483,CVE-2026-34487,CVE-2026-34500 Vulnerability Details CVEID:CVE-2026-41284 DESCRIPTION: Allocation of Resources Without Limits or...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40974)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40974 Vulnerability Details CVEID:CVE-2026-40974 DESCRIPTION: Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spri...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40972)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40972 Vulnerability Details CVEID:CVE-2026-40972 DESCRIPTION: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. ...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40973, CVE-2026-40975, CVE-2026-40977)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40973, CVE-2026-40975, CVE-2026-40977 Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...

CVE-2026-79708

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2024-11222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

EUVD-2024-55768

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...