164827 matches found
Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.10, bundled with IBM Cloud Pak for Applications, is affected by multiple vulnerabilities
Summary IBM WebSphere Application Server Liberty prior to 26.0.0.10, which is bundled with IBM Cloud Pak for Applications, is affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...
Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.10, bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities
Summary IBM WebSphere Application Server Liberty prior to 26.0.0.10, which is bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...
Security Bulletin: A vulnerability within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.
Summary A vulnerability within KCCI WebSphere Liberty Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2025-36047 DESCRIPTION: IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a deni...
Security Bulletin: A vulnerability within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.
Summary A vulnerability within KCCI WebSphere Liberty Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2025-14923 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere...
K000163638: Linux kernel vulnerability CVE-2026-46181
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4srqevent Sashiko points out the radixtree itself is RCU safe, but nothing ever frees the mlx4srq struct with RCU, and it isn't even accessed within the RCU critic...
GHSA-68W4-83FH-F2W8 pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
Summary Api.getUserData legacy and Api.getuserdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/getuserdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
Summary Api.getUserData legacy and Api.getuserdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/getuserdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...
GHSA-9Q47-3CM2-2RP8 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...
pyLoad: Api.set_user_permission never invalidates the target's session
Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/setuserpermission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...
GHSA-889W-M37P-88M5 pyLoad: Api.set_user_permission never invalidates the target's session
Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/setuserpermission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...
Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Netty
Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-62380 DESCRIPTION: Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain...
K000163640: Apache Struts vulnerabilities CVE-2026-104711, CVE-2026-104712, CVE-2026-104713, and CVE-2026-104714
Security Advisory Description CVE-2026-104711 Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject...
Security Bulletin: IBM® Db2® could allow a DBADM authenticated user to send a specially crafted request to write arbitrary files on the system (CVE-2026-86087)
Summary IBM® Db2® could allow a database administration authority DBADM authenticated user to send a specially crafted request to write arbitrary files on the system CVE-2026-86087 Vulnerability Details CVEID:CVE-2026-86087 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 cou...
Strawberry legacy graphql-ws retains naturally completed subscription slots
Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...
GHSA-M952-2W3F-6R8H Strawberry legacy graphql-ws retains naturally completed subscription slots
Summary Strawberry's legacy graphql-ws subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its complete message. When the application configures maxsubscriptionsperconnection, the handler counts those completed operations in...
Security Bulletin: Multiple vulnerabilities in IBM Cloud Pak System
Summary Multiple vulnerabilities were found in linux kernel, libssh expat, libssh, openSSL in Platform System Manager PSM OS Image for Red Hat Enterprise Linux v8 shipped with IBM Cloud Pak System. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...
Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak
Summary A security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. JavaScript is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fix...
Security Bulletin: Security vulnerability in Golang affects IBM Robotic Process Automation for Cloud Pak
Summary A security vulnerability in Golang affects IBM Robotic Process Automation. Golang is used by IBM Robotic Process Automation as part of its deployment. This bulletin identifies the fixes required to resolve the vulnerabilities. Vulnerability Details CVEID:CVE-2026-56864 DESCRIPTION: A...
Security Bulletin: Security vulnerability in Java affects IBM Robotic Process Automation
Summary A security vulnerability in Java affects IBM Robotic Process Automation. Java is used by IBM Robotic Process Automation as part of its deployment. This bulletin identifies the fixes required to resolve the vulnerabilities. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS...