Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition

Summary This bulletin for IBM SDK, Java Technology Edition covers all applicable Java SE CVEs published by Oracle as part of their July 2026 Critical Patch Update. For more information please refer to Oracle's July 2026 CPU Advisory and the CVE links referenced below. Vulnerability Details...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-16184)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to execute arbitrary JavaScript by exploiting insufficient sanitization of href and...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site scripting due to Angular (CVE-2026-27970)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular internationalization i18n pipeline could allow attacker-controlled JavaScript to execute if a malicious translation file is...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to privilege escalation due to IBM WebSphere Application Server Liberty (CVE-2025-14915)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A privilege escalation vulnerability in IBM WebSphere Application Server Liberty, when the restConnector-1.0 or restConnector-2.0 feature is enabled, could allow ...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are affected by multiple vulnerabilities in IBM SDK, Java Technology Edition (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary IBM Storage Protect Client and Virtual Environments includes IBM SDK, Java Technology Edition to support Java-based components. Multiple vulnerabilities in the IBM SDK, Java Technology Edition could allow an attacker to obtain unauthorized access to sensitive information or cause a partia...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are affected by an identity spoofing vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-3621)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. Under limited conditions, when an application is deployed without authentication and authorization configured, IBM WebSphere Application Server Liberty ...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to remote code execution due to IBM WebSphere Application Server Liberty (CVE-2025-14914)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a privileged user to upload a specially crafted ZIP archive containing path...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to denial of service due to jose4j (CVE-2024-29371)

Summary IBM Storage Protect Client and Virtual Environments use the jose4j library as part of its security infrastructure. A vulnerability in jose4j could allow an attacker to cause a denial of service DoS by sending a specially crafted JSON Web Encryption JWE token with an exceptionally high...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to denial of service due to jose4j (CVE-2024-29371)

Summary IBM Storage Protect for Space Management uses the jose4j library as part of its security infrastructure. A vulnerability in jose4j could allow an attacker to cause a denial of service DoS by sending a specially crafted JSON Web Encryption JWE token with an exceptionally high compression...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A vulnerability in Angular's HttpClient could allow the leakage of Cross-Site Request Forgery XSRF tokens when protocol-relative URLs are used, potentially exposing the token to an...

Security Bulletin: IBM Storage Protect for Space Management is affected by an identity spoofing vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-3621)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. Under limited conditions, when an application is deployed without authentication and authorization configured, IBM WebSphere Application Server Liberty is...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A vulnerability in Angular's HttpClient could allow the leakage of Cross-Site Request Forgery XSRF tokens when protocol-relative URLs are used, potentially exposing the token to an attacker-controlled...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to remote code execution due to IBM WebSphere Application Server Liberty (CVE-2025-14914)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a privileged user to upload a specially crafted ZIP archive containing path traversal...

Security Bulletin: Langflow is affected by security vulnerabilities in Model Context Protocol features

Summary Langflow uses Model Context Protocol MCP features to manage external server connections, project access, file resources, and local client integration. Weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling, and request...

GHSA-X83G-979R-F5FH Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /locale/thank-you PageRedirectController::thankYouAction, route syliusmollieshopthankyoupageredirect loads the order with...

Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /locale/thank-you PageRedirectController::thankYouAction, route syliusmollieshopthankyoupageredirect loads the order with...

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Summary ReviewsCorpusReader extracts feature annotations of the form label followed by a bracketed signed digit e.g. a label then +2 from each review line, using the module-level FEATURES regex. The feature-label sub-pattern is unbounded — an optional greedy run of word-plus-whitespace groups...