Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in Postgres [CVE-2026-54291]

Summary Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in Postgres, due to a flaw in the pgjdbc open source postgresql JDBC Driver. CVE-2026-54291. Postgres is included in our Java Microservices. This vulnerability has been addressed. Please re...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents [CVE-2026-54399]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents, due to a flaw in the HTTP/1.1 message parser CVE-2026-54399. Apache HttpComponents is used in our Java Microservices. This vulnerability has been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in HdrHistogram [CVE-2026-14683, CVE-2026-14684, CVE-2026-14685, CVE-2026-14686]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in HdrHistogram CVE-2026-14683, CVE-2026-14684, CVE-2026-14685, CVE-2026-14686. HdrHistogram is used in our Java Microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents [CVE-2026-54428]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents due to a flaw in HTTP/2 HPACK decoder which could lead to a D.O.S. CVE-2026-54428. Apache HttpComponents is used in our Java Microservices...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Boot [CVE-2026-40992, CVE-2026-41001]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Boot due to flaws in Mail auto-configuration and ArtemisEmbeddedConfigurationFactory CVE-2026-40992, CVE-2026-41001. Spring Boot is used as part of our microservices. These vulnerabilities have been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC or WebFlux CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846. Spring MVC is used as part of our microservices. These vulnerabilities have been addressed. Please read the detail...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the detai...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41850, CVE-2026-41851, CVE-2026-41852]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational [CVE-2026-41697]

Summary IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational, due to a failure to properly escape binding values of externally-controlled input hat can allow an attacker can supply wildcard characters CVE-2026-41697. Spring Data Relational, is used as par...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service ReDoS in Spring Framework CVE-2026-41848. Spring Framework is used as part of our microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Data Commons [CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721 ]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Data Commons CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721 . Spring Data Commons is used in our microservices. These vulnerabilities have been addressed. Please read the details for remediatio...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple D.o.S. issues in Micrometer [CVE-2026-40983, CVE-2026-40984]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple D.o.S. issues in Micrometer due to issues in CVE-2026-40983, CVE-2026-40984. Micrometer is used in our speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerabili...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith [CVE-2026-41182]

Summary IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith, due to an issue that causes a bypass of the redaction pipeline CVE-2026-41182. LangSmith is used in our runtime postprocessor. This vulnerability has been addressed. Please read the details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a D.o.S. in IDNA [CVE-2026-45409]

Summary IBM Watson Speech Services Cartridge is vulnerable to a D.o.S. in IDNA, due to an Inefficient Regular Expression Complexity issue CVE-2026-45409. IDNA is used in our speech runtimes. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability Detail...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in urllib3 [CVE-2026-44431, CVE-2026-44432]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in urllib3 CVE-2026-44431, CVE-2026-44432, urllib3 is used in our speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-4443...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Moby [CVE-2026-34040]

Summary IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Moby, due to a flaw that allows attackers to bypass authorization plugins AuthZ CVE-2026-34040. Moby is used in our speech catalog. This vulnerability has been addressed. Please read the details for remediati...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a privilege validation bypass in Moby [CVE-2026-33997]

Summary IBM Watson Speech Services Cartridge is vulnerable to a privilege validation bypass in Moby, due to an error in the daemon's privilege comparison logic, which allows the daemon to incorrectly accept a privilege set that differs from the one approved by the user CVE-2026-33997. Moby is use...

Lessons from the OpenAI and Hugging Face Incident: When Safety Filters Disarm the Defender

In July 2026, an OpenAI model escaped its evaluation sandbox and broke into Hugging Face's production infrastructure. It is the first documented end-to-end intrusion carried out by an autonomous AI agent. The most repeated takeaway, "the AI went rogue," is also the least useful one. The real...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to incomplete validation in LangChain [CVE-2026-40087]

Summary IBM Watson Speech Services Cartridge is vulnerable to incomplete validation in LangChain, due to flaws in the f-string prompt-template. CVE-2026-40087. LangChain is used in our speech runtimes. This vulnerability has been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in google.protobuf [CVE-2026-0994]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in google.protobuf, due to an issue that allows maxrecursiondepth limit to be bypassed when parsing nested google.protobuf.Any messages. CVE-2026-0994. Google.protobuf is used in our speech service runtimes. This...