Security Bulletin: Multiple Security vulnerabilities impacting watsonx.data integration

Summary Multiple Security vulnerabilities impacting watsonx.data integration. These vulnerabilities have been addressed and customers should update to version 5.3.1 at the earliest opportunity. Vulnerability Details CVEID:CVE-2026-33151 DESCRIPTION: Socket.IO is an open source, real-time,...

Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 75c59285ee1a5a83447815e7402410ccfca6a287e0c36d61bcfda3d55396f608 Versions published in 2026-07 after the package was removed by the original author and the name was re-registered by another contain a stub 'share compute swar...

MAL-2026-11198 Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 75c59285ee1a5a83447815e7402410ccfca6a287e0c36d61bcfda3d55396f608 Versions published in 2026-07 after the package was removed by the original author and the name was re-registered by another contain a stub 'share compute swar...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVE-2026-50645, CVE-2026-9322, CVE-2026-9171)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by uncontrolled resource consumption and denial of service. Vulnerability Details CVEID:CVE-2026-9171 DESCRIPTION: IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerabl...

CVE-2026-62663

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters image, audio, video, document in banks accept untrusted user input as file paths via Pathvalue and pass them directly to openfilepath, "rb" without any path sanitization,...

DEBIAN-CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

DEBIAN-CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

ALPINE-CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-13379

The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...

ALPINE-CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

ALPINE-CVE-2026-12932

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service memory exhaustion via a flood of crafted packets...

DEBIAN-CVE-2026-12932

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service memory exhaustion via a flood of crafted packets...

CVE-2026-12932

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service memory exhaustion via a flood of crafted packets...

Malicious code in ai-perf-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 41d25387636c9b0b89a404304d079c30ad28bda33bb551e551cb9e15a75c00ba During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed. --- Category: MALICIOUS - The campaign...

MAL-2026-11197 Malicious code in ai-perf-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 41d25387636c9b0b89a404304d079c30ad28bda33bb551e551cb9e15a75c00ba During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed. --- Category: MALICIOUS - The campaign...

EUVD-2026-51202

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...

CVE-2026-48499 Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...