Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses joserfc-1.6.4-py3-none-any.whl, HdrHistogram-2.2.2.jar, and logback-core-1.5.32.jar which are vulnerable to CVE-2026-62995, CVE-2026-14683, CVE-2026-14684, CVE-2026-10532, and CVE-2026-9828. This bulletin contains information regarding the vulnerability and its fix...

Security Bulletin: Vulnerability in Java affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Java has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in logback-core [CVE-2026-10532, CVE-2026-9828]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in logback-core CVE-2026-10532, CVE-2026-9828. Logback-core is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM SPSS Modeler is affected by an arbitrary code execution vulnerability in Logback Core

Summary IBM SPSS Modeler is affected by an arbitrary code execution vulnerability in Logback Core. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-13006 DESCRIPTION: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up t...

Security Bulletin: IBM Terracotta is affected by Logback vulnerabilities that could allow deserialization of untrusted data resulting in object injection

Summary IBM Terracotta uses Logback for logging purposes within the product. Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit...

Linux Distros Unpatched Vulnerability : CVE-2026-19880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path- traversal vulnerability. More specifically, an MDC-based...

Directory Traversal

Overview ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java. Affected versions of this package are vulnerable to Directory Traversal in MDCBasedDiscriminator, used by SiftingAppender, which takes an MDC value as the discriminating key without removin...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

DEBIAN-CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

UBUNTU-CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58667

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

CVE-2026-19880 affects Logback-classic (Java) with a path-traversal flaw where an MDC discriminator value flows into a nested FileAppender path, enabling log file creation outside the intended directory. Affected versions: 0.9.14 through 1.6.2. Per linked advisories, the recommended remediation i...

CVE-2026-19880 Incomplete protection against CVE-2025-11226

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880 Incomplete protection against CVE-2025-11226

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

PT-2026-72028

Name of the Vulnerable Software and Affected Versions Logback-classic versions 0.9.14 through 1.6.2 Description A path-traversal issue exists in the logback-classic module. An MDC-based discriminator value is passed unsanitized into a nested FileAppender path. This allows an attacker who can...

CVE-2026-19880: Improper Limitation of a Pathname to a Restricted Directory

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

Security Bulletin:Vulnerability in logback-core affects IBM Netezza Appliance

Summary The logback-core package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-10532, CVE-2026-9828 Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core...