Security Bulletin: Multiple Vulnerabilities in IBM Engineering AI hub.

Summary Multiple vulnerabilities were addressed in IBM Engineering AI Hub version 1.3.0. Vulnerability Details CVEID:CVE-2026-41182 DESCRIPTION: LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the...

Security Bulletin: IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

Summary XML Entity Expansion vulnerability has been identified in IBM Engineering Lifecycle Management - Jazz Foundation. Vulnerability Details CVEID:CVE-2026-14979 DESCRIPTION: DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion...

Security Bulletin: IBM Jazz Reporting Service is affected by RDF/XML parser of Apache Jena

Summary Apache Jena is used internally by IBM Jazz Reporting Service CVE-2022-28890. Apache Jena could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity XXE declarations by the RDF/XML parser. By sending a specially crafted request, a remo...

Security Bulletin: IBM Jazz Reporting Service is affected by Cross-site Scripting (XSS) of spin.js

Summary Spin.js is used internally by IBM Jazz Reporting Service. The vulnerability arises from the spin function, which can trigger multiple alert dialogs per target element. Vulnerability Details CVEID:CVE-2026-3884 DESCRIPTION: Versions of the package spin.js before 3.0.0 are vulnerable to...

Security Bulletin: IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service (CVE-2026-7771)

Summary IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service. Vulnerability Details CVEID:CVE-2026-7771 DESCRIPTION: DB2 for Linux is vulnerable to a trap when compiling a specially crafted statements containing...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is affected by a cross-site request forgery vulnerability

Summary The security issue described in CVE-2026-8408 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

Security Bulletin: IBM Automation Decision Services for June 2026- Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Automation Decision Services. See full list below. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data...

Security Bulletin: IBM Engineering Lifecycle Management - Doors Next is impacted by vulnerabilities

Summary A vulnerability has been identified in poi-ooxml library, which is used in IBM Engineering Lifecycle Management - Doors Next. Vulnerability Details CVEID:CVE-2025-31672 DESCRIPTION: Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files...

Security Bulletin: Multiple Vulnerabilities in IBM StreamSets SDK for Python

Summary Multiple vulnerabilities were addressed in IBM StreamSets SDK for Python 7.0.2 Vulnerability Details CVEID:CVE-2026-44431 DESCRIPTION: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

Security Bulletin: Vulnerability in SVGO bundled with IBM Fusion and IBM Fusion HCI, and IBM Fusion Content-Aware Storage

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the SVGO library, which is affected by an XML entity expansion vulnerability. CVE-2026-29074 Vulnerability Details CVEID:CVE-2026-29074 DESCRIPTION: SVGO, short for SVG Optimizer, is a Node.js library and command-lin...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability (CVE-2026-11546)

Summary IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Vulnerability Details CVEID:CVE-2026-11546 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability (CVE-2026-11714)

Summary IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability with the apiDiscovery-1.0 feature enabled. Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-sid...

Security Bulletin: Multiple Vulnerabilities in React Router bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the react-router library, which is affected by multiple vulnerabilities, including cross-site scripting XSS, cross-site request forgery CSRF, and open redirect vulnerabilities. CVE-2026-21884, CVE-2026-22029, CVE-2026-2203...

Security Bulletin: Vulnerability in Flask-HTTPAuth bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the Flask-HTTPAuth library, which is affected by an improper authentication vulnerability. CVE-2026-34531 Vulnerability Details CVEID:CVE-2026-34531 DESCRIPTION: Flask-HTTPAuth provides Basic, Digest and Token HTTP...

Security Bulletin: Vulnerability in serialize-javascript bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the serialize-javascript library, which is affected by a denial of service vulnerability. CVE-2026-34043 Vulnerability Details CVEID:CVE-2026-34043 DESCRIPTION: Serialize JavaScript to a superset of JSON that includes...

Security Bulletin: Vulnerability in fast-uri bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the fast-uri library, which is affected by a path traversal vulnerability. CVE-2026-6321 Vulnerability Details CVEID:CVE-2026-6321 DESCRIPTION: fast-uri decoded percent-encoded path separators and dot segments before...

Security Bulletin: Vulnerability in lxml bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the lxml library, which is affected by an XML External Entity XXE vulnerability. CVE-2026-41066 Vulnerability Details CVEID:CVE-2026-41066 DESCRIPTION: lxml is a library for processing XML and HTML in the Python language...

Security Bulletin: Vulnerability in path-to-regexp bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the path-to-regexp library, which is affected by a regular expression denial of service ReDoS vulnerability. CVE-2026-4867 Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generate...

Security Bulletin: Vulnerability in socket.io-parser bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the socket.io-parser component, which is affected by a denial of service vulnerability. CVE-2026-33151 Vulnerability Details CVEID:CVE-2026-33151 DESCRIPTION: Socket.IO is an open source, real-time, bidirectional,...

Security Bulletin: Vulnerability in pydicom bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the pydicom library, which is affected by a path traversal vulnerability. CVE-2026-32711 Vulnerability Details CVEID:CVE-2026-32711 DESCRIPTION: pydicom is a pure Python package for working with DICOM files. Versions...

Security Bulletin: Due to use of NodeJS, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Due to use of NodeJS libraries, IBM Cloud Pak System Software is affected by multiple vulnerabilities. These have been addressed in IBM Cloud Pak System Software version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-22036 DESCRIPTION: Undici is an HTTP/1.1 client for Node.js. Prior to...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-34077 DESCRIPTION: React...

Security Bulletin: Vulnerability in Pallets Click bundled with IBM Fusion and IBM Fusion HCI

Summary IBM Fusion and IBM Fusion HCI include the click library, which is affected by a command injection vulnerability. CVE-2026-7246 Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit...

Security Bulletin: Vulnerability in bytes bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the bytes library, which is affected by an integer overflow vulnerability. CVE-2026-25541 Vulnerability Details CVEID:CVE-2026-25541 DESCRIPTION: Bytes is a utility library for working with bytes. From version 1.2.1 ...

Security Bulletin: Vulnerability in undici bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the undici library, which is affected by a denial of service vulnerability. CVE-2026-22036 Vulnerability Details CVEID:CVE-2026-22036 DESCRIPTION: Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0,...

Security Bulletin: Vulnerability in follow-redirects bundled with IBM Fusion and IBM Fusion HCI

Summary IBM Fusion and IBM Fusion HCI include the follow-redirects library, which is affected by an information exposure vulnerability. CVE-2026-40895 Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules...

Security Bulletin: IBM DataStage Flow Designer application is affected by an information disclosure vulnerability (CVE-2026-9836)

Summary An information disclosure vulnerability was addressed in IBM DataStage Flow Designer . Vulnerability Details CVEID:CVE-2026-9836 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability. CWE:CWE-200: Exposure of...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub - urllib3, tornado, tensorflow, requests, pythondotenv, pytest, Pygments, idna, flask, certifi, react-router, brace-expansion, golang.org/x/sys, golang.org/x/net, golang.org/x/crypto, axios, RedisBloom, redis,...

Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (May 2026)

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities

Summary IBM Guardium Data Security Center has addressed these vulnerabilities with an update. Vulnerability Details CVEID:CVE-2026-41683 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3,...

Security Bulletin: IBM WebSphere Application Server Liberty shipped with IBM OpenPages is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty is shipped as a supporting program of IBM OpenPages affected by identity spoofing CVE-2026-3621, CVE-2025-14917 and CVE-2026-1561 . Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change

Summary IBM Operations Analytics - Log Analysis contains a Time-Of-Check to Time-Of-Use TOCTOU weakness in its built-in user password management feature. The built-in authentication module of IBM Operations Analytics - Log Analysis is used by IBM Operations Analytics - Log Analysis as part of the...

Security Bulletin: Vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-10845, CVE-2026-8646, CVE-2026-9320, CVE-2026-9071 and CVE-2026-9006)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

Security Bulletin: IBM webMethods BPM is vulnerable to a denial of service due to org.eclipse.core.runtime

Summary IBM webMethods BPM uses org.eclipse.core.runtime which contains the Eclipse Workbench API classes used to create and manage workbench windows, views, editors, and perspectives. Vulnerability Details CVEID:CVE-2023-4218 DESCRIPTION: In Eclipse IDE versions 2023-09 4.29 some files with xml...

Security Bulletin: Multiple log4j related security vulnerabilities in IBM Guardium Key Lifecycle Manager

Summary Multiple security vulnerabilities related to log4j have been addressed in IBM Guardium Key Lifecycle Manager Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in JavaScript

Summary There are multiple vulnerabilities in JavaScript used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend and the...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in JavaScript

Summary There are multiple vulnerabilities in JavaScript used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to...

Security Bulletin: Security vulnerabilities have been detected in IBM Security Verify Governance Identity Manager Adapters

Summary IBM Security Verify Governance Identity Manager Adapters use jackson-databind-2.15.2.jar, jackson-databind-2.18.6.jar and jackson-databind-2.21.1.jar, which is affected by multiple security vulnerabilities Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains t...

Security Bulletin: Security vulnerabilities have been detected in IBM Security Verify Governance Identity Manager Adapters

Summary IBM Security Verify Governance Identity Manager Adapters use jackson-databind-2.15.2.jar, jackson-databind-2.18.6.jar and jackson-databind-2.21.1.jar, which is affected by multiple security vulnerabilities Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains t...

Security Bulletin: Multiple vulnerabbilities exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager.

Summary IBM Tivoli Network Configuration Manager is affected by multiple security vulnerabilities in IBM SDK, Java Technology Edition. This bulletin addresses the IBM SDK, Java Technology Edition Quarterly Critical Patch Update CPU for April 2026, which includes Oracle's April 2026 Critical Patch...

Security Bulletin: IBM Storage Scale System: Vulnerability in Linux kernel crypto subsystem could allow local privilege escalation (CVE-2026-31431)

Summary IBM Storage Scale Systems is affected by a security vulnerability identified in the Linux kernel's cryptographic interface CVE-2026-31431 that could allow a local user with low privileges to escalate to root privileges. The vulnerability has a CVSS score of 7.8 High and requires local...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries (CVE-2026-10695)

Summary IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries. Vulnerability Details CVEID:CVE-2026-10695 DESCRIPTION: IBM Db2 federated server is vulnerable to a denial of service when running non fenced federated queries. CWE:CWE-400: Uncontrolled Resource...

Security Bulletin: IBM® Db2® is affected by a vulnerability in log4j-core (CVE-2026-34479)

Summary IBM® Db2® is affected by a vulnerability in log4j-core. Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parser...

Security Bulletin: IBM® Db2® is affected by a vulnerability in netty-codec-http-4.1.130.Final.jar (CVE-2026-41417)

Summary IBM® Db2® is affected by a vulnerability in netty-codec-http-4.1.130.Final.jar Vulnerability Details CVEID:CVE-2026-41417 DESCRIPTION: Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via...

Security Bulletin: IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc (CVE-2026-10535)

Summary IBM® Db2® is vulnerable to uffer overflow in setgid helper db2flacc. Vulnerability Details CVEID:CVE-2026-10535 DESCRIPTION: IBM Db2 is vulnerable to buffer overflow in setgid helper db2flacc. CWE:CWE-121: Stack-based Buffer Overflow CVSS Source: IBM CVSS Base score: 8.4 CVSS...

Security Bulletin: Multiple vulnerabilities in IBM Semeru affects IBM® Db2® (April 2026 CPU)

Summary There are vulnerabilities in IBM Runtime Environment Java™ Version 8.0.8.60 and earlier, and IBM Semeru Version 21.0.10.0 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in April 2026 Vulnerability Details CVEID:CVE-2026-22021 DESCRIPTION:...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)

Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94: Improper Control of...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-8408)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Security Bulletin: Vulnerability in IBM Data Product Hub

Summary A vulnerability was addressed in IBM Data Product Hub version 5.4.0 Patch 2 Vulnerability Details CVEID:CVE-2026-9358 DESCRIPTION: A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the...

Security Bulletin: Security vulnerability in IBM Storage Protect Client leads to unauthorized access to IBM Storage Protect Snapshot for Windows Standalone Configuration

Summary Security vulnerability in IBM Storage Protect Client leads to unauthorized access to IBM Storage Protect Snapshot for Windows Standalone Configuration. CVE-2026-12628 Vulnerability Details CVEID:CVE-2026-12628 DESCRIPTION: IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage...