Security Bulletin: MANTA Automated Data Lineage is vulnerable to an authorization check bypass

Summary Next.js is used by MANTA Automated Data Lineage as part of the UI. CVE-2025-29927. Vulnerability Details CVEID:CVE-2025-29927 DESCRIPTION: Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to Rack ( CVE-2024-26141 )

Summary Rack is used by IBM Cloud Pak for Data as part of the platform. CVE-2024-26141. Vulnerability Details CVEID:CVE-2024-26141 DESCRIPTION: Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Respondin...

IBM Cloud Pak for Business Automation Denial of Service Vulnerability

IBM Cloud Pak for Business Automation is a modular set of integrated software components from International Business Machines IBM, built for any hybrid cloud, designed to automate work and accelerate business growth. A denial of service vulnerability exists in IBM Cloud Pak for Business Automatio...

Security Bulletin: Vulnerability in requests affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-35195].

Summary The requests package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-35195. Vulnerability Details CVEID:CVE-2024-35195 DESCRIPTION: Psf Requests could allow a local authenticated attacker to bypass security...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.9.1 Vulnerability Details undefined Affected Products and Versions Affected Products| Versions ---|--- IBM Cloud Pak for AIOps| 4.1.0 - 4.9.0 Remediation/Fixes IBM strongly suggests that you address the...

Security Bulletin: Vulnerability in Jinja2 affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-34064].

Summary The Jinja2 package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-34064. Vulnerability Details CVEID:CVE-2024-34064 DESCRIPTION: Jinja is vulnerable to cross-site scripting, caused by the acceptance of keys...

Security Bulletin: Vulnerability in idna affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-3651].

Summary The idna package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-3651. Vulnerability Details CVEID:CVE-2024-3651 DESCRIPTION: idna could allow a local user to cause a denial of service using a specially crafted...

Security Bulletin: Vulnerability in Jinja2 affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-22195].

Summary The Jinja2 package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-22195. Vulnerability Details CVEID:CVE-2024-22195 DESCRIPTION: Jinja is an extensible templating engine. Special placeholders in the template allow...

Security Bulletin: IBM Cloud Kubernetes Service on Ubuntu20 is affected by a FreeType Remote Code Execution security vulnerability (CVE-2025-27363)

Summary IBM Cloud Kubernetes Service is affected by a FreeType Remote Code Execution security vulnerability CVE-2025-27363 which is included in Ubuntu20 distributions, but not applicable to Ubuntu24 distributions. Vulnerability Details CVE-2025-27363 Description: An out of bounds write exists in...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a FreeType Remote Code Execution security vulnerability (CVE-2025-27363)

Summary Red Hat OpenShift on IBM Cloud is affected by a FreeType Remote Code Execution security vulnerability CVE-2025-27363 which is included in Red Hat Enterprise Linux versions 8 and 9 distributions. Vulnerability Details CVE-2025-27363 Description: An out of bounds write exists in FreeType...

Security Bulletin: Vulnerability in Log4j affects IBM Cloud Pak for Data Systems 1.0 (CPDS 1.0) [CVE-2023-26464]

Summary Redhat provided Log4j is used by IBM Cloud Pak for Data System 1.0 . IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2023-26464 Vulnerability Details CVEID:CVE-2023-26464 DESCRIPTION: UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components wit...

USN-7492-1: Linux kernel vulnerability

A security issues was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystems: - Bluetooth drivers; CVE-2024-56653...

Security Bulletin: Vulnerability in zipp affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-5569].

Summary The zipp package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-5569. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: zipp is vulnerable to a denial of service, caused by an infinite loop flaw in the Path...

Security Bulletin: Vulnerability in certifi affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2023-37920]

Summary The certifi package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2023-37920 Vulnerability Details CVEID:CVE-2023-37920 DESCRIPTION: An unspecified error with the removal of e-Tugra root certificate in Certifi has an...

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to a vulnerability found in Node.js

Summary There is a vulnerability in Node.js used by IBM Cloud Transformation Advisor CVE-2024-57699. Vulnerability Details CVEID:CVE-2024-57699 DESCRIPTION: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number...

Security Bulletin: IBM Cloud Pak for Business Automation images repackage a vulnerable version of freetype - CVE-2025-27363

Summary Some of the container images in IBM Cloud Pak for Business Automation include a vulnerable version of freetype. Vulnerability Details CVEID:CVE-2025-27363 DESCRIPTION: An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of FreeType are not vulnerable when...

Security Bulletin: Vulnerability in certifi affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-39689].

Summary The certifi package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-39689. Vulnerability Details CVEID:CVE-2024-39689 DESCRIPTION: Certifi is a curated collection of Root Certificates for validating the...

Security Bulletin: Vulnerability in gunicorn affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-1135].

Summary The gunicorn package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-1135. Vulnerability Details CVEID:CVE-2024-1135 DESCRIPTION: Gunicorn is vulnerable to HTTP request smuggling, caused by improper parsing of the...

Security Bulletin: Vulnerability in jinja2 affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-56201, CVE-2024-56326].

Summary The jinja2 package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-56201, CVE-2024-56326. Vulnerability Details CVEID:CVE-2024-56201 DESCRIPTION: Jinja is an extensible templating engine. In versions on the 3.x bran...

Security Bulletin: Vulnerability in gunicorn affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-6827].

Summary The gunicorn package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-6827. Vulnerability Details CVEID:CVE-2024-6827 DESCRIPTION: Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encodin...