Security Bulletin: watsonx.ai on Cloud Pak for Data is vulnerable to Uncontrolled Resource Consumption due to netty-codec-http2-4.1.72.Final (CVE-2023-44487)

Summary netty-codec-http2 is used by watsonx.ai on Cloud Pak for Data for its Watson Document Understanding runtime component Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset...

CVE-2026-113180

A flaw was found in the ContentCapture component of Google Chrome on Android. This memory corruption vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox by enticing a victim to open a specially crafted HTML page...

Important: Red Hat Security Advisory: Red Hat Cost Management On-Premise container image update

Updated container image for Red Hat Cost Management On-Premise is now available. Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

Workshop on Economics and Information Security (WEIS) Archive

There's a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security WEIS. Really nice resource. It's fun to reread my 2002 essay on the economics of information security...

EUVD-2026-106864

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters...

Linux Distros Unpatched Vulnerability : CVE-2026-109245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdphttprequest in libfreerdp/utils/http.c that completes TLS...

AlmaLinux 9.2 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792597970)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792597970 advisory. - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes...

Linux Distros Unpatched Vulnerability : CVE-2026-113145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-56339 DESCRIPTION: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker...

CVE-2026-81212

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters...

DEBIAN-CVE-2026-113323

Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native.

Enable native runtime protection for GKE in just one click. The Wiz Runtime Sensor add-on now automates deployment and credential management while delivering predictable, kernel-level eBPF threat detection for your GKE Kubernetes fleets...

CVE-2026-81212 DataStage on Cloud Pak for Data Improper Authorization

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters...

CVE-2026-81212

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an improper authorization flaw (CWE-285) that allows an unauthenticated user to perform an arbitrary write into the shared Redis instance. This vulnerability allows an anonymous caller to write data under any tenant's key, effectively c...

GO-2026-6776 vulnerabilities

Vulnerabilities for packages: kserve, k8sgpt, kserve-localmodelnode-agent, keda-http-add-on, keda-http-add-on-fips, kserve-fips, kserve-localmodelnode-agent-fips...

CVE-2026-93003

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-94018

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (October 2026 - Part 2 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-0636 DESCRIPTION: Improper neutralization of special elements used in a...