Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Cloud Pak for Data System 1x to provide web application server functionality. CVE-2026-10051 affects Jetty's HTTP/1.1 request handling when trailers are retained across multiple requests on the same connection, potentially exposing sensitive information from...

Security Bulletin:Vulnerability in libssh affects IBM Netezza Appliance

Summary The libssh package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2025-5318 Vulnerability Details CVEID:CVE-2025-5318 DESCRIPTION: A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in th...

Security Bulletin:Vulnerability in grub affects IBM Netezza Appliance

Summary The grub package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2024-45777 Vulnerability Details CVEID:CVE-2024-45777 DESCRIPTION: A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by HTTP message parser vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Cloud Pak for Data System 1x to provide HTTP client and server functionality. CVE-2026-54399 affects Apache HttpComponents Core's HTTP/1.1 message parser when processing messages with excessive headers or header lengths, allowing remote attackers ...

Growing Up The Hard Way

Open Source had a great childhood. For two decades it got to be a kid. It ran around barefoot, gave everything away, trusted strangers, and never once thought about who was watching. It ran the kind of lemonade stand that took IOUs from anyone who wandered up — take what you need, pay me back...

Security Bulletin:Vulnerability in Vim affects IBM Netezza Appliance

Summary The Vim package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2025-53905, CVE-2025-53906 Vulnerability Details CVEID:CVE-2025-53905 DESCRIPTION: Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issu...

Security Bulletin: Vulnerability in SSSD affects IBM Netezza Appliance

Summary The SSSD package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-14476 Vulnerability Details CVEID:CVE-2026-14476 DESCRIPTION: A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not...

Security Bulletin:Vulnerability in Kernel affects IBM Netezza Appliance

Summary The Kernel package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2023-52933 Vulnerability Details CVEID:CVE-2023-52933 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking ...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

Security Bulletin: Vulnerability in tar affects IBM Netezza Appliance

Summary The tar package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-59873 Vulnerability Details CVEID:CVE-2026-59873 DESCRIPTION: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard uppe...

Security Bulletin: IBM WebSphere eXtreme Scale is affected by multiple CVEs

Summary Multiple vulnerabilities were addressed in IBM WebSphere eXtreme Scale ifix PH72363 Vulnerability Details CVEID:CVE-2026-2950 DESCRIPTION: Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for CVE-2025-13465:...

Security Bulletin:Vulnerability in Kernel affects IBM Netezza Appliance

Summary The Kernel package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2025-21964 Vulnerability Details CVEID:CVE-2025-21964 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0. Vulnerability Details CVEID:CVE-2023-28370 DESCRIPTION: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary...

Security Bulletin: Jackson-Core Async JSON Parser Bypasses Number Length Constraint Leading to Denial of Service

Summary Jackson-core's non-blocking async JSON parser fails to enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters, unlike the synchronous parser which correctly applies the limit. An attacker can submit JSON containing arbitrarily long numbers through...

Security Bulletin: Apache Commons Configuration Denial of Service via YAML Cycle

Summary Apache Commons Configuration versions 2.2 through 2.14.x are vulnerable to an uncontrolled recursion denial of service. When parsing an untrusted YAML configuration file that contains cyclic references, the library throws a StackOverflowError, which can crash the processing thread and mak...

Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename

Summary form-data versions through 4.0.5 are vulnerable to CRLF injection CWE-93, CVSS 7.5, High. Field names and filenames passed to FormDataappend are not sanitized before being written into the Content-Disposition header, allowing an attacker who controls those values to inject arbitrary heade...

Security Bulletin: Eclipse Parsson JSON Parser Denial of Service via Unbounded Input

Summary Eclipse Parsson versions before 1.1.8 are vulnerable to uncontrolled resource consumption CWE-400, CVSS 7.5, High. The JSON parser imposed no default limit on the number of characters consumed per document, allowing an attacker to supply a crafted oversized JSON payload — including large...

Security Bulletin: Vulnerability in tar affects IBM Netezza Appliance

Summary The tar package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-59874 Vulnerability Details CVEID:CVE-2026-59874 DESCRIPTION: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-vali...

Security Bulletin:i18nextify JavaScript Library: URL-Injection Vulnerability Prior to 3.0.5

Summary i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template...