207 matches found
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in nanoid (CVE-2026-73086)
Summary A predictable unique ID generation vulnerability in the nanoid generator library CVE-2026-73086 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.3.17. Vulnerability Details CVEID:CVE-2026-73086 DESCRIPTION: nanoid is a secure,...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in PySpark (CVE-2025-55039)
Summary A deserialization vulnerability in the PySpark component CVE-2025-55039 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.5.8. Vulnerability Details CVEID:CVE-2025-55039 DESCRIPTION: This issue affects Apache Spark versions before 3.4.4...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-24486, CVE-2026-40347, CVE-2026-42561)
Summary Multiple vulnerabilities including path traversal and Denial of Service in the python-multipart streaming parser library CVE-2026-24486, CVE-2026-40347, CVE-2026-42561 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32. Vulnerabili...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in DOMPurify (CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914)
Summary Multiple HTML sanitization and mutation Cross-Site Scripting mXSS vulnerabilities in the DOMPurify library CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914 used by IBM InfoSphere Optim Archive...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-13676)
Summary A domain label parsing boundary vulnerability in the fast-uri URI parsing library CVE-2026-13676 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in libxml2
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package libxml2 that is affected by three critical-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerability in github.com/slackhq/nebula package
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerability in github.com/slackhq/nebula package. IBM optim 1.2.0 resolves this vulnerability by upgrading the package from vulnerable version Vulnerability Details CVEID:CVE-2026-25793 DESCRIPTION: Nebula is a scalable overlay networking...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the package bind9.18-libs, bind9.18-utils.
Summary Impacted IBM optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the package bind9.18-libs, bind9.18-utils. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-1519 DESCRIPTION: If a BIND...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in jackc/pgx
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package jackc/pgx that is affected by a critical-severity vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected open-source dependency to fixed version. Vulnerability Details CVEID:CVE-2026-338...
Security Bulletin: Impacted IBM Optim 1.2.0 by vulnerabilities in scrapy
Summary IBM Optim version 1.2.0 depends on an open-source package scrapy which is affected by a high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details CVEID:CVE-2025-6176 DESCRIPTION:...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 impacted by a denial of service vulnerability in axios
Summary axios is used by IBM Optim as part of its front-end user interface for making HTTP requests from the browser. CVE-2026-25639, A denial of service vulnerability exists in axios prior to versions 0.30.3 and 1.13.5, where the mergeConfig function crashes with a TypeError when processing a...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerabilities in crypto/x509 package.
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerabilities in crypto/x509 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2025-61729 DESCRIPTION: Within HostnameError.Error,...
Security Bulletin: IBM Optim 1.1.0 impacted by vulnerability in lodash-es 4.17.21
Summary IBM Optim 1.1.0 includes lodash-es 4.17.21 as an npm dependency in the archon-ui component. This version is affected by CVE-2025-13465, a prototype pollution vulnerability that allows a remote attacker to manipulate JavaScript object prototypes via specially crafted input, potentially...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1
Summary webkit2gtk3-jsc, gstreamer1-plugins-base, libtiff, and giflib are bundled with IBM Optim as part of its base OS image; Eclipse Jetty jetty-io is used for HTTP server infrastructure; Apache ZooKeeper zookeeper is used for distributed coordination; Jackson Core jackson-core is used for JSON...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 ,1.2.0 by vulnerabilities in the package google.golang.org/grpc
Summary Impacted IBM optim 1.0.0, 1.1.0 ,1.2.0 by vulnerabilities in the package google.golang.org/grpc. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by a vulnerability in Go's HTTP/2 transport
Summary BM Optim versions 1.0.0, 1.1.0, and 1.2.0 include the Go net/http package, which is affected by a high-severity denial-of-service vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected Go dependency to a fixed version. Vulnerability Details CVEID:CVE-2026-338...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in form-data 4.0.5
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source package axios which transitively depends on package form-data, which is affected by a high severity vulnerability. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by XSS, open redirect, denial of service, and remote code execution vulnerabilities in react-router 7.7.0 / 7.12.0
Summary react-router is used by IBM Optim as part of its front-end user interface Optim UI to provide client-side and server-side routing for the web application. CVE-2026-33244 and CVE-2026-33245 are cross-site scripting XSS vulnerabilities in react-router's redirect and RSC handling;...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in cloudflare/cfSSL
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package cloudflare/cfSSL that is affected by a medium-severity vulnerability. IBM Optim 2.0.0 resolves this vulnerability by removing the affected dependency. Vulnerability Details CVEID:CVE-2021-34558 DESCRIPTION: The...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in nghttp2 and libarchive
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source packages nghttp2 and libarchive that are affected by three high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Detail...