CVE-2026-81832 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity XXE attack...

EUVD-2026-71152

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity XXE attack...

CVE-2026-81832

IBM App Connect Enterprise (versions 13.0.1.0–13.0.8.1 and 12.0.1.0–12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0–10.1.0.7) are affected through the SAP Adapter , which is vulnerable to an XML External Entity (XXE) attack. The CVSS 3.1 score is 7.7 (HIGH) with a scope-changing, network-a...

CVE-2026-81859

IBM Enterprise Records (part of Cloud Pak for Business Automation ) is vulnerable to information disclosure due to the use of a broken or risky cryptographic algorithm . A local attacker with no privileges required can obtain sensitive information, resulting in high confidentiality impact (CVSS 3...

EUVD-2026-71150

CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm...

CVE-2026-81859 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm...

EUVD-2026-71217

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when...

CVE-2026-9138

IBM Langflow OSS 1.0.0 through 1.11.2 contains an arbitrary file write vulnerability (CVE-2026-9138) in the SaveToFileComponent , which constructs local file paths from attacker-controlled input without sufficient sanitization on the /api/v1/run/{flow_id} endpoint. A low-privileged authenticated ...

EUVD-2026-71216

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

EUVD-2026-71215

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files /.cursor/mcp.json, etc...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by IBM Tivoli System Automation for Multiplatforms. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the...

PT-2026-85662

🚨 HIGH Severity Alert CVE-2026-81832 | CVSS 7.7 IBM App Connect Enterprise & Integration Bus vulnerable to XXE attack allowing confidential data exposure. Affected: ACE 12.0.1.0-12.0.12.28, 13.0.1.0-13.0.8.1 & IB for z/OS 10.1.0.0-10.1.0.7 https://t.co/Iln5WlecgQ...

PT-2026-85776

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters...

PT-2026-85775

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher...

PT-2026-85672

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.2 Description A URL parser discrepancy allows a remote authenticated attacker to obtain sensitive information from internal services. This issue occurs because a backslash can be used to bypass...

CVE-2026-9736

IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-9744

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2026-9745

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an...

CVE-2026-9036

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...