Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core-2.25.2.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core-2.25.2.jar Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pypdf

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pypdf Vulnerability Details CVEID:CVE-2026-33123 DESCRIPTION: pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtim...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in python_dotenv

Summary IBM Watson Discovery Cartridge affected by vulnerability in pythondotenv Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec

Summary IBM Watson Discovery Cartridge affected by vulnerability in netty-codec Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in axios

Summary IBM Watson Discovery Cartridge affected by vulnerability in axios Vulnerability Details CVEID:CVE-2026-67312 DESCRIPTION: axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty Vulnerability Details CVEID:CVE-2026-18499 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in sanitize-html

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in sanitize-html Vulnerability Details CVEID:CVE-2026-44990 DESCRIPTION: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under...

The vulnerability of the Discovery Framework component of the Oracle Enterprise Manager Base Platform allows a hacker to gain full control over the application.

The vulnerability of the Discovery Framework component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTPS protocol...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pyasn1

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pyasn1 Vulnerability Details CVEID:CVE-2026-59884 DESCRIPTION: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in jackson-databind-2.16.0.jar

Summary IBM Watson Discovery Cartridge affected by vulnerability in jackson-databind-2.16.0.jar Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in IBM SDK, Java Technology Edition Quarterly CPU

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in IBM SDK, Java Technology Edition Quarterly CPU Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols t...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in form-data-3.0.4.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in form-data-3.0.4.tgz Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend and the filenam...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in dompurify

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in dompurify Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in faraday

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in faraday Vulnerability Details CVEID:CVE-2026-54297 DESCRIPTION: Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including 2.25.3, fails t...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in keras

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in keras Vulnerability Details CVEID:CVE-2026-11816 DESCRIPTION: Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/fileutils.py. T...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in json

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in json Vulnerability Details CVEID:CVE-2026-71847 DESCRIPTION: Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in keras-3.15.0-py3-none-any.whl

Summary IBM Watson Discovery Cartridge affected by vulnerability in keras-3.15.0-py3-none-any.whl Vulnerability Details CVEID:CVE-2026-12484 DESCRIPTION: A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in netty-transport-native-epoll

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in netty-transport-native-epoll Vulnerability Details CVEID:CVE-2026-42577 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transpor...