CLEANSTART-2026-RS65756 Security fixes for CVE-2018-10237, CVE-2020-8908, CVE-2021-22569, CVE-2021-22570, CVE-2022-3171, CVE-2022-3509, CVE-2022-3510, CVE-2023-2976, CVE-2023-44981, CVE-2024-23454, CVE-2024-23944, CVE-2024-38827, CVE-2024-47554, CVE-2024-6763, CVE-2024-7254, CVE-2025-11143, CVE-2025-24970, CVE-2025-25193, CVE-2025-27821, CVE-2025-41249, CVE-2025-48734, CVE-2025-48924, CVE-2025-49128, CVE-2025-52999, CVE-2025-53864, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-59419, CVE-2025-67735, CVE-2025-68161, CVE-2025-8916, CVE-2026-0636, CVE-2026-2332, CVE-2026-24281, CVE-2026-24308, CVE-2026-33870, CVE-2026-33871, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-40490, CVE-2026-41417, CVE-2026-42578, CVE-2026-42579, CVE-2026-42583, CVE-2026-42586, CVE-2026-43869, CVE-2026-44248, CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45205, CVE-2026-45300, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-5588, ghsa-2r2c-cx56-8933, ghsa-3244-j874-rhc2, ghsa-3qp7-7mw8-wx86, ghsa-45q3-82m4-75jr, ghsa-47qp-hqvx-6r3f, ghsa-5jmj-h7xm-6q6v, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-5xrh-qmmq-w6ch, ghsa-676x-f7gg-47vc, ghsa-6ghj-frrj-jjj3, ghsa-72hv-8253-57qq, ghsa-7pwc-h2j2-rjgj, ghsa-cc37-9q2j-3hfv, ghsa-cm33-6792-r9fm, ghsa-cmxv-58fp-fm3g, ghsa-fmxf-pm6p-7xgm, ghsa-hvcg-qmg6-jm4c, ghsa-jfg9-48mv-9qgx, ghsa-mj4r-2hfc-f8p6, ghsa-rgrr-p7gp-5xj7, ghsa-w573-9ffj-6ff9, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 4.2.0-r0, 4.2.0-r1, 4.2.0-r2, 4.2.0-r3, 4.2.0-r4, 4.2.0-r5, 4.2.0-r6, 4.2.0-r7

Multiple security vulnerabilities affect the apache-hive package. These issues are resolved in later releases. See references for individual vulnerability details...

Security Bulletin: Multiple vulnerabilities in IBM Controller

Summary Multiple vulnerabilities were addressed in IBM Controller. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in log4j-core-2.25.2.jar

Summary IBM Watson Discovery Cartridge affected by vulnerabilities in log4j-core-2.25.2.jar Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerability to man-in-the-middle attacks due to the log4j package (CVE-2025-68161)

Summary DataStage on Cloud Pak for Data uses log4j as part of logging functionality. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the...

PT-2026-31939

Name of the Vulnerable Software and Affected Versions Apache Log4j Core versions 2.12.0 through 2.25.3 Description A flaw exists where hostname verification is ignored when configured through the verifyHostName attribute of the '' element. This occurs even if the attribute is explicitly set,...

Security Bulletin: Due to use of Apache Log4j, IBM Sterling Connect:Direct Web Services is affected by TLS hostname verification issue.

Summary Apache Log4j is used by IBM Sterling Connect:Direct Web Services CVE-2025-68161. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when...

CVE-2025-68161 vulnerabilities

Vulnerabilities for packages: sonarqube, akhq, strimzi-kafka-operator, wavefront-proxy, flink, apache-pulsar, celeborn, opensearch, confluent-kafka, kserve-modelmesh, neo4j, druid, kafka, zipkin, apache-activemq-artemis, apache-tika, spark, solr...