Security Bulletin: Multiple Vulnerabilities in IBM CloudPak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-29074 DESCRIPTION: SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1,...

CLSA-2026-1790944130 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.15.2-tuxcare.1...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses netty-handler-4.1.135.Final.jar, ion-java-1.11.1.jar, js-yaml-4.3.0.tgz, tar-7.5.20.tgz, python3.12 3.12.13-3.el98, github.com/go-jose/go-jose/v4 v4.1.3, github.com/apache/thrift v0.22.0, and google.golang.org/grpc 1.71.0 which are vulnerable to CVE-2026-62243,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.56 security and extras update

Red Hat OpenShift Container Platform release 4.18.56 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.58 security and extras update

Red Hat OpenShift Container Platform release 4.17.58 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a security impact of...

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.4.0...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

CLEANSTART-2026-RI71860 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...

CLSA-2026-1790597988 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.3.0-tuxcare.2...

ROOT-APP-NPM-GHSA-8J8C-7JFH-H6HX GHSA-8j8c-7jfh-h6hx in js-yaml - Patched by Root

Root has patched GHSA-8j8c-7jfh-h6hx in the js-yaml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-84375 CVE-2026-84375 in js-yaml - Patched by Root

Root has patched CVE-2026-84375 in the js-yaml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-5P4M-2WFM-XMQJ GHSA-5p4m-2wfm-xmqj in js-yaml - Patched by Root

Root has patched GHSA-5p4m-2wfm-xmqj in the js-yaml package for Root:npm. Multiple fixed versions available...

CLSA-2026-1790522263 TuxCare security update for js-yaml (2 CVEs)

TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 4.2.0-tuxcare.1...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

CLSA-2026-1790187722 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.7.0-tuxcare.3...

CLSA-2026-1790186133 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.14.2-tuxcare.2...

CLSA-2026-1790183141 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.3.1-tuxcare.3...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in js-yaml (CVE-2026-53550)

Summary A Denial of Service vulnerability in the js-yaml document parsing library CVE-2026-53550 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.3.1. Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser...