Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

Summary IBM ContextForge MCP Gateway mcp-contextforge-gateway validates REST tool target URLs for server-side request forgery SSRF only once, at tool-registration time. When the same tool is later invoked, the stored URL is used directly without re-validation or DNS-resolution pinning, allowing a...

Security Bulletin: IBM ContextForge Translate is affected by cross-client credential context confusion

Summary IBM ContextForge Translate utility contains a credential context confusion vulnerability in the Translate service mcpgateway/translate.py when the --enable-dynamic-env opt-in flag is active. The Translate service is a standalone component within the IBM ContextForge codebase that bridges...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0)

Summary Vulnerabilities exists in IBM Cloud Pak for Data System CPDS 1.0 addressed in 11.3.1.2-IF1 Vulnerability Details CVEID:CVE-2026-14350 DESCRIPTION: The product could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written ...

Security Bulletin: Vulnerability in commons-configuration2 impacts IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent is affected by Uncontrolled recursion vulnerability in Apache Commons CVE-2026-45205 Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. Wh...

Security Bulletin: Due to use of bootstrap, IBM License Key Server Administration and Reporting Tool is affected by Cross-site scripting

Summary IBM License Key Server Administration and Reporting Tool uses bootstrap javascript library internally. Vulnerability Details CVEID:CVE-2025-1647 DESCRIPTION: Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Bootstrap allows...

Security Bulletin: IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent is affected by a vulnerability in httpcore5 jar (CVE-2026-54399)

Summary IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent are affected by a vulnerability CVE-2026-54399 reported for httpcore5 jar Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 messa...

Security Bulletin: IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent are vulnerable to improper encoding in Apache Log4j [CVE-2026-49844]

Summary IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent are vulnerable to Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API, which produces output that is not valid JSON CVE-2026-49844. This...

Security Bulletin: Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a message can contai...

Security Bulletin: Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only when enabled v...

Security Bulletin: IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

Summary IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment. Vulnerability Details CVEID:CVE-2025-33141 DESCRIPTION: IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backu...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2025-10911 DESCRIPTION: A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0)

Summary Vulnerabilities exists in IBM Cloud Pak for Data System CPDS 1.0 addressed in 11.3.1.2-IF1 Vulnerability Details CVEID:CVE-2025-38527 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifsoplockbreak A race condition can...

Security Bulletin: Multiple security vulnerabilities in .NET affect IBM Robotic Process Automation

Summary Multiple security vulnerabilities in .NET affect IBM Robotic Process Automation. .NET is used by IBM Robotic Process as part of it's development framework. This security bulletin identifies the fixes required to resolve these vulnerabilities Vulnerability Details CVEID:CVE-2026-41319...

Security Bulletin: Security vulnerability in Java affects IBM Robotic Process Automation

Summary A security vulnerability in Java affects IBM Robotic Process Automation. Java is used by IBM Robotic Process Automation as part of its deployment. This bulletin identifies the fixes required to resolve the vulnerabilities. Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak...

Security Bulletin: IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE [CVE-2026-18887]

Summary IBM i is vulnerable to allowing sensitive information access to unauthorized users CVE-2206-18887 in Portable Application Solutions Environment PASE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18887 DESCRIPTION: IBM i could allow an authenticate...

Security Bulletin: IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [CVE-2026-17470, CVE-2026-17469]

Summary IBM i is vulnerable to denial of service due to a buffer overflow and off-by-one write CVE-2026-17470, CVE-2026-17469 in Line Printer Daemon LPD as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17470 DESCRIPTION: IBM i could allow a remote attacker t...