Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 2.0 have been addressed in version 11.3.1.3-IF7 Vulnerability Details CVEID:CVE-2026-59999 DESCRIPTION: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did...

CVE-2026-3161

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-3295

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing...

CVE-2026-4418

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2023-38375

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2023-38375 IBM Cloud Pak System Cross-Site Scripting

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2023-38375

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to cross-site scripting (XSS) (CWE-79). This flaw allows users to embed arbitrary JavaScript code within the Web UI, which can alter intended functionality and potentially lead to credentials disclosure during a trusted session. The...

EUVD-2023-60720

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-3161

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to the use of weaker than expected cryptographic algorithms (CWE-327). This flaw could enable an attacker to decrypt highly sensitive information. Impact is rated as High for confidentiality. To remediate this vulnerability, IBM str...

EUVD-2026-104522

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-3161 IBM Cloud Pak System Risky Cryptographic Algorithm

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-3161 IBM Cloud Pak System Risky Cryptographic Algorithm

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-3295 IBM Cloud Pak System Cross-Site Scripting

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing...

CVE-2026-3295

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to Stored Cross-Site Scripting (Stored XSS) . The root cause is that the web application fails to properly sanitize or HTML-encode user-supplied input before storing and rendering it. An authenticated attacker can exploit this by pr...

EUVD-2026-104521

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing...

CVE-2026-4418

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to HTML injection (CWE-80). A remotely authenticated attacker can inject malicious HTML code that executes within a victim's web browser under the hosting site's security context. This vulnerability was addressed in version 2.3.6.2 ...

CVE-2026-4418 IBM Cloud Pak System HTML Injection

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

EUVD-2026-104520

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-4418: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-3161: Use of a Broken or Risky Cryptographic Algorithm

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...