Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in idna

Summary IBM Watson Discovery Cartridge affected by vulnerability in idna Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in sanitize-html

Summary IBM Watson Discovery Cartridge affected by vulnerability in sanitize-html Vulnerability Details CVEID:CVE-2026-53606 DESCRIPTION: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-ht...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core-2.25.2.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core-2.25.2.jar Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pypdf

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pypdf Vulnerability Details CVEID:CVE-2026-33123 DESCRIPTION: pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtim...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in python_dotenv

Summary IBM Watson Discovery Cartridge affected by vulnerability in pythondotenv Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec

Summary IBM Watson Discovery Cartridge affected by vulnerability in netty-codec Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in axios

Summary IBM Watson Discovery Cartridge affected by vulnerability in axios Vulnerability Details CVEID:CVE-2026-67312 DESCRIPTION: axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty Vulnerability Details CVEID:CVE-2026-18499 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in sanitize-html

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in sanitize-html Vulnerability Details CVEID:CVE-2026-44990 DESCRIPTION: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pyasn1

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pyasn1 Vulnerability Details CVEID:CVE-2026-59884 DESCRIPTION: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in jackson-databind-2.16.0.jar

Summary IBM Watson Discovery Cartridge affected by vulnerability in jackson-databind-2.16.0.jar Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in dompurify

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in dompurify Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including 2.25.3, fails t...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in keras

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in keras Vulnerability Details CVEID:CVE-2026-11816 DESCRIPTION: Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/fileutils.py. T...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in json

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in json Vulnerability Details CVEID:CVE-2026-71847 DESCRIPTION: Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in netty-transport-native-epoll

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in netty-transport-native-epoll Vulnerability Details CVEID:CVE-2026-42577 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transpor...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer Vulnerability Details CVEID:CVE-2026-5038 DESCRIPTION: Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malform...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.135.Final.jar

Summary IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.135.Final.jar Vulnerability Details CVEID:CVE-2026-59899 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder...