Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND [CVE-2026-3039]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND, due to a flaw in BIND servers that are configured to use TKEY-based authentication via GSS-API tokens, which makes them vulnerable to excessive memory consumption when receiving and processing maliciously-constructed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in NLnet Labs Unbound [CVE-2026-33278]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in NLnet Labs Unbound, due to a flaw in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a privilege escalation in PostgreSQL [CVE-2026-6475]

Summary IBM Watson Speech Services Cartridge is vulnerable to a privilege escalation due to an issues in PostgreSQL pgbasebackup plain format and in pgrewind that allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to credential exposure in PostgreSQL [CVE-2026-6478]

Summary IBM Watson Speech Services Cartridge is vulnerable to credential exposure in PostgreSQL, due to covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication which allows an attacker to recover user credentials sufficient to authenticate CVE-2026-6478. PostgreSQL...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in NLnet Labs Unbound [CVE-2026-42959]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in NLnet Labs Unbound, due to a flaw in the DNSSEC validator that can lead to a crash given malicious upstream replies. CVE-2026-42959. NLnet Labs Unbound is used in our service speech utilities. This vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND [CVE-2026-5946]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in ISC BIND, due to multiple flaws causing an Improper Input Validation CVE-2026-5946. ISC BIND is used as part of our speech utilities. This vulnerability has been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery (SSRF) vulnerability in kubernetes [CVE-2025-13281]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery SSRF vulnerability in kubernetes, due to an issue in kube-controller-manager when using the in-tree Portworx StorageClass CVE-2025-13281. Kubernetes is used as part of our speech utilities. This...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an out-of-bounds read in onnx [CVE-2026-14647]

Summary IBM Watson Speech Services Cartridge is vulnerable to an out-of-bounds read in onnx that affects the function convPoolShapeInferenceopset19 of the file onnx/defs/nn/old.cc of the component onnxruntime CVE-2026-14647. Onnx is used as part of our service runtimes. This vulnerability has bee...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in Python [CVE-2026-57585]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in Python, due to an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack CVE-2026-57585. Python is used in our service runtimes. This vulnerability has been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in logback-core [CVE-2026-10532, CVE-2026-9828]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in logback-core CVE-2026-10532, CVE-2026-9828. Logback-core is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in jackson-databind [CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in jackson-databind CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515. Jackson-databind is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediati...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details...

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray including roo...

GHSA-JM48-M3RR-9HGG 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray including roo...

K000163067: Apache Thrift vulnerabilities CVE-2026-48586 and CVE-2026-55969

Security Advisory Description CVE-2026-48586 Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes th...

GHSA-8JJ7-4V57-FRF5 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

Acelle-Mail-4.0.24-Unauthenticated-Path-Traversal-to-RCE-Chain

Acelle Mail Note: The path traversal alone Step 1 is su...

GHSA-XM98-3VCF-FPH7 mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py Vulnerability RestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses...

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py Vulnerability RestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses...