Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to multiple issues

Summary There are vulnerabilities in IBM Semeru Runtime version 17 used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable CVEs CVE-2026-34282, CVE-2026-22016, CVE-2026-23865, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-2200...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2026-5079 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2026-5079 Source advisory:...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody was using Older version of Java which as per Oracle's January 2026 Critical Patch Update, all affecting Oracle Java SE and related GraalVM runtimes. Collectively, they highlight weaknesses in how Java handles untrusted code,...

PT-2026-49299

Name of the Vulnerable Software and Affected Versions SNMP4J-Agent version 3.8.3 Description A remote attacker can execute arbitrary code through the snmp4jCfgStoragePath component. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

Security update for java-17-openj9 (important)

openSUSE Security Update: Security update for java-17-openj9 Announcement ID: openSUSE-SU-2026:0208-1 Rating: important References: 1252414 1252417 1257034 1257036 1257037 1257038 1259118 1262490 1262494 1262495 1262496 1262497 1262500 1262501 1265261 1267355 PED-14507 Cross-References:...

Security update for java-11-openj9 (important)

openSUSE Security Update: Security update for java-11-openj9 Announcement ID: openSUSE-SU-2026:0207-1 Rating: important References: 1252414 1252417 1257034 1257036 1257037 1257038 1259118 1262490 1262494 1262495 1262496 1262497 1262500 1262501 1265261 1267355 PED-14507 Cross-References:...

openSUSE 16 Security Update : java-21-openj9 (openSUSE-SU-2026:20947-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20947-1 advisory. Changes in java-21-openj9: - Make post scripts less noisy bsc1267355 - Use libalternatives instead of update-alternatives for distributions wher...

openSUSE 16 Security Update : java-17-openj9 (openSUSE-SU-2026:20943-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20943-1 advisory. Changes in java-17-openj9: - Make post scripts less noisy bsc1267355 - Use libalternatives instead of update-alternatives for distributions wher...

org.webjars.npm:github-com-daichirata-vue-sanitize (0.2.2), org.webjars.npm:github-com-daichirata-vue-sanitize- (0.2.2) potentially affected by CVE-2026-53606 via org.webjars.npm:sanitize-html (2.7.0)

org.webjars.npm:sanitize-html MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sanitize-html and may be impacted: - org.webjars.npm:github-com-daichirata-vue-sanitize 0.2.2 -...

CVE-2026-48043

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the...

com.github.arucard21.simplyrestful:deploy-jetty-cxf (>=0.17.4, <=0.18.2), com.github.arucard21.simplyrestful:deploy-springboot-cxf (>=0.17.4, <=0.18.2) +353 more potentially affected by CVE-2026-49875 via org.apache.cxf:cxf-core (3.4.4)

org.apache.cxf:cxf-core MAVEN version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-core and may be impacted: - com.github.arucard21.simplyrestful:deploy-jetty-cxf =0.17.4, =0.17.4, =4.9.2, =4.9.2, =4.0.0-beta.1, =4.1.0 -...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), no.ks.fiks:adresseregisteret-client (>=1.0.0-rc1, <=1.4.0) +16 more potentially affected by CVE-2026-50629 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50629 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339177...

Security Bulletin: Multiple vulnerabbilities exist in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager IP Edition core components

Summary Multiple vulnerabilities exist in IBM® SDK Java™ Technology Edition, Version 17.0.18.0, which is used by IBM Tivoli Network Manager IP Edition v4.2 Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access...

CVE-2026-49875

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band OOB external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.x) Platform - Multiple Vulnerabilities in IBM Java

Summary IBM Cloud Pak for Data System CPDS 1.x Platform uses IBM Java versions that are affected by multiple critical vulnerabilities disclosed in the Oracle January 2026 CPU advisory. The vulnerabilities impact IBM Java 7.1 prior to 7.1.5.29 and 8.0 prior to 8.0.8.60. These vulnerabilities affec...

CVE-2026-50633

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or...

EUVD-2026-36401

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7,...

EUVD-2026-36400

A further incomplete fix for a previous advisory CVE-2026-44417 Untrusted JMS configuration can lead to RCE for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions...

Security Bulletin: IBM Event Streams is affected by multiple vulnerabilities in Java SE (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933).

Summary IBM Event Streams is affected by multiple vulnerabilities in Java SE. These vulnerabilities could allow a remote attacker to cause a denial of service condition, bypass security restrictions, or perform unauthorized operations on data processed by affected Java components. Vulnerability...

OPENSUSE-SU-2026:20947-1 Security update for java-21-openj9

This update for java-21-openj9 fixes the following issues: Changes in java-21-openj9: - Make post scripts less noisy bsc1267355 - Use libalternatives instead of update-alternatives for distributions where libalternatives is available - Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine ...