43 matches found
Security Bulletin: Impacted IBM Optim for z/OS 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in jackc/Pgx, cloudflare/cfSSL, x/net
Summary IBM Optim for z/OS version 1.0.0, 1.1.0 and 1.2.0 depends on open-source packages jackc/Pgx, cloudflare/cfSSL and x/net which are affected by medium, high and critical severity vulnerabilities. IBM Optim for z/OS 2.0.0 resolves these vulnerabilities by upgrading the affected open-source...
Security Bulletin: IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities (CWE-22)
Summary IBM Optim Test Data Management versions 1.0.0, 1.1.0, and 1.2.0 are affected by three medium-severity vulnerabilities including File Path Traversal, Abuse of Functionality with No Rate Limiting, and Weak Password Policy. IBM Optim Test Data Management 2.0.0 resolves these vulnerabilities ...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in aircompressor, libarchive, gstreamer1, LIBPNG, bind9, giflib, react-router, dompurify
Summary IBM Optim version 1.0.0, 1.1.0 and 1.2.0 depends on open-source packages aircompressor, libarchive, gstreamer1, LIBPNG, bind9, giflib, react-router, dompurify which are affected by medium, high and critical severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in libxml2
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package libxml2 that is affected by three critical-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerability in github.com/slackhq/nebula package
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerability in github.com/slackhq/nebula package. IBM optim 1.2.0 resolves this vulnerability by upgrading the package from vulnerable version Vulnerability Details CVEID:CVE-2026-25793 DESCRIPTION: Nebula is a scalable overlay networking...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the package bind9.18-libs, bind9.18-utils.
Summary Impacted IBM optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the package bind9.18-libs, bind9.18-utils. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-1519 DESCRIPTION: If a BIND...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in jackc/pgx
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package jackc/pgx that is affected by a critical-severity vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected open-source dependency to fixed version. Vulnerability Details CVEID:CVE-2026-338...
Security Bulletin: Impacted IBM Optim 1.2.0 by vulnerabilities in scrapy
Summary IBM Optim version 1.2.0 depends on an open-source package scrapy which is affected by a high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details CVEID:CVE-2025-6176 DESCRIPTION:...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 impacted by a denial of service vulnerability in axios
Summary axios is used by IBM Optim as part of its front-end user interface for making HTTP requests from the browser. CVE-2026-25639, A denial of service vulnerability exists in axios prior to versions 0.30.3 and 1.13.5, where the mergeConfig function crashes with a TypeError when processing a...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerabilities in crypto/x509 package.
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerabilities in crypto/x509 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2025-61729 DESCRIPTION: Within HostnameError.Error,...
Security Bulletin: IBM Optim 1.1.0 impacted by vulnerability in lodash-es 4.17.21
Summary IBM Optim 1.1.0 includes lodash-es 4.17.21 as an npm dependency in the archon-ui component. This version is affected by CVE-2025-13465, a prototype pollution vulnerability that allows a remote attacker to manipulate JavaScript object prototypes via specially crafted input, potentially...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1
Summary webkit2gtk3-jsc, gstreamer1-plugins-base, libtiff, and giflib are bundled with IBM Optim as part of its base OS image; Eclipse Jetty jetty-io is used for HTTP server infrastructure; Apache ZooKeeper zookeeper is used for distributed coordination; Jackson Core jackson-core is used for JSON...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 ,1.2.0 by vulnerabilities in the package google.golang.org/grpc
Summary Impacted IBM optim 1.0.0, 1.1.0 ,1.2.0 by vulnerabilities in the package google.golang.org/grpc. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by a vulnerability in Go's HTTP/2 transport
Summary BM Optim versions 1.0.0, 1.1.0, and 1.2.0 include the Go net/http package, which is affected by a high-severity denial-of-service vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected Go dependency to a fixed version. Vulnerability Details CVEID:CVE-2026-338...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in form-data 4.0.5
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source package axios which transitively depends on package form-data, which is affected by a high severity vulnerability. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by XSS, open redirect, denial of service, and remote code execution vulnerabilities in react-router 7.7.0 / 7.12.0
Summary react-router is used by IBM Optim as part of its front-end user interface Optim UI to provide client-side and server-side routing for the web application. CVE-2026-33244 and CVE-2026-33245 are cross-site scripting XSS vulnerabilities in react-router's redirect and RSC handling;...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in cloudflare/cfSSL
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package cloudflare/cfSSL that is affected by a medium-severity vulnerability. IBM Optim 2.0.0 resolves this vulnerability by removing the affected dependency. Vulnerability Details CVEID:CVE-2021-34558 DESCRIPTION: The...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in nghttp2 and libarchive
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source packages nghttp2 and libarchive that are affected by three high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Detail...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the packages picomatch-2.3.1.tgz.
Summary Impacted IBM Optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the packages picomatch-2.3.1.tgz. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 impacted by a denial of service vulnerability in quic-go
Summary quic-go github.com/quic-go/quic-go is used by IBM Optim as part of its network transport layer, providing a Go implementation of the QUIC protocol used for high-performance HTTP/3 communication.CVE-2025-59530 — A denial of service vulnerability exists in quic-go prior to version 0.54.1. A...