Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.81.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.37.0, <=1.39.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.37.0, =0.81.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: SNYK:JAVA-COMLINECORPARMERIA-17391817...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.39.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: MEND:CVE-2026-11752...

[SECURITY] Fedora 43 Update: ongres-scram-3.3-1.fc43

This is a Java implementation of SCRAM Salted Challenge Response Authentication Mechanism which is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. It is described as part of RFC 5802 and RFC7677...

PT-2026-50975

Name of the Vulnerable Software and Affected Versions CedarJava versions prior to 2.3.6 CedarJava versions prior to 3.4.1 CedarJava versions prior to 4.9 Description Improper input handling allows Record-to-Entity type confusion across the Java-Rust FFI Foreign Function Interface boundary...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.39.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: GHSA-HGW6-8C77-V4GQ...

com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.39.0)

com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: OSV:GHSA-HGW6-8C77-V4GQ...

org.cometd.java:cometd-java-annotation-server (>=5.0.0, <=5.0.22), org.cometd.java:cometd-java-benchmark-server (>=5.0.0, <=5.0.22) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=5.0.0, <=5.0.22)

org.cometd.java:cometd-java-server-common MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.2, =5.0.22 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.0.0-m1, <=3.6.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.0.0-m1, <=3.6.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=7.0.0, <=7.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =7.0.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =7.0.0, =7.0.0, =7.0.0, =7.0.11, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.18 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.cometd.java:cometd-java-annotation-server (>=6.0.0, <=6.0.18), org.cometd.java:cometd-java-benchmark-server (>=6.0.0, <=6.0.18) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=6.0.0, <=6.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.18 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

EUVD-2025-210276

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution RCE. Version 2.27.0 fixes...

Security Bulletin: IBM Tivoli Monitoring is included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent

Summary IBM Tivoli Monitoring is included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocol...

Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access bsc1262490. CVE-2026-22013: unauthenticated attacker with network access can access to critical data bsc1262494. CVE-2026-22016: APIs in the specified...

SUSE-SU-2026:2453-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues - CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access bsc1262490. - CVE-2026-22013: unauthenticated attacker with network access can access to critical data bsc1262494. - CVE-2026-22016: APIs in the...

JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

Summary The JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option. An unauthenticated attacker can flood the server with a large number of unique variable pairs before sending the terminating IAC SE byte,...

Security Bulletin: Due to use of IBM SDK, Java Technology Edition, IBM Tivoli Application Dependency Discovery Manager is vulnerable to Buffer overflow in OMR

Summary There is a Buffer overflow vulnerability in OMR allows denial-of-service in IBM® SDK Java™ Technology Edition used by IBM Tivoli Application Dependency Discovery Manager TADDM. Vulnerability Details CVEID:CVE-2026-1188 DESCRIPTION: In the Eclipse OMR port library component since release...

ROOT-APP-MAVEN-CVE-2023-43642 CVE-2023-43642 in io.root.org.xerial.snappy:snappy-java - Patched by Root

Root has patched CVE-2023-43642 in the io.root.org.xerial.snappy:snappy-java package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-34454 CVE-2023-34454 in io.root.org.xerial.snappy:snappy-java - Patched by Root

Root has patched CVE-2023-34454 in the io.root.org.xerial.snappy:snappy-java package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-34455 CVE-2023-34455 in io.root.org.xerial.snappy:snappy-java - Patched by Root

Root has patched CVE-2023-34455 in the io.root.org.xerial.snappy:snappy-java package for Root:Maven. Multiple fixed versions available...