36662 matches found
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pacote which is vulnerable to CVE-2026-9496
Summary IBM Maximo Application Suite - Visual Inspection component uses pacote which is vulnerable to CVE-2026-9496, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-9496 DESCRIPTION: Versions of the package pacote from 11.2....
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Torch - 2.3.1+cu121 which is vulnerable to CVE-2025-32434
Summary IBM Maximo Application Suite - Visual Inspection component uses Torch - 2.3.1+cu121 which is vulnerable to CVE-2025-32434 ,This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-32434 DESCRIPTION: PyTorch is a Python packag...
Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse jetty-ee10-jaspi library that could cause broken access controls, potentially allowing unauthorized access or privilege escalation. (CVE-2026-5795).
Summary IBM Storage Protect Server uses the Eclipse jetty-ee10-jaspi library in certain components. A vulnerability in Jetty could cause authentication context being retained in ThreadLocal variables and inadvertently reused by subsequent requests processed on the same thread. This can lead to...
Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could allow remote attacker to send a large number of specially crafted frames, causing excessive CPU consumption (CVE-2026-33871).
Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow remote attacker to send a large number of specially crafted CONTINUATION frames, causing excessive CPU consumption and rendering the server unresponsive. The issue aris...
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920, CVE-2026-4372
Summary IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920,CVE-2026-4372. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Huggi...
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses brace-expansion which is vulnerable to CVE-2026-13149
Summary IBM Maximo Application Suite - Visual Inspection component uses brace-expansion which is vulnerable to CVE-2026-13149, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 ...
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses form-data which is vulnerable to CVE-2026-12143
Summary IBM Maximo Application Suite - Visual Inspection component uses form-data which is vulnerable to CVE-2026-12143, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating...
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to multiple vulnerabilities
Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595...
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506
Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506, This bulletin contains information regarding the vulnerability an...
Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-44249)
Summary There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In...
Security Bulletin: There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-47244, CVE-2026-48043)
Summary There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-47244 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...
Security Bulletin: There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs
Summary There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs mentioned below. Vulnerability Details CVEID:CVE-2026-48712 DESCRIPTION: protobuf...
Security Bulletin: There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50020)
Summary There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50020 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...
Security Bulletin: There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50560)
Summary There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50560 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...
Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a privilege escalation
Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a privilege escalation CVE-2026-14446 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...
Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50010)
Summary There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50010 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...
Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server Liberty is affected by a security bypass issue (CVE-2026-5516)
Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is affected by a security bypass issue. This issue has been addressed in this release. Vulnerability...
Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service (DoS) flaw (CVE-2024-26308, CVE-2024-25710)
Summary IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service DoS flaw. All those libraries have been upgraded and this issue has been addressed in this release. Vulnerability Details CVEID:CVE-2024-26308...
Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (CVE-2026-4410)
Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service. This issue has been addressed i...
Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes ( CVE-2026-34478)
Summary IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. This issue has been fixed in this release by incorporating the Apache...
Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server Liberty is affected by a denial of service in glassfish jsonp (CVE-2025-36097)
Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is affected by a denial of service in glassfish jsonp. This issue has been addressed in this release...
Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses WebSphere Application Server Liberty, which is vulnerable to cross-site scripting (CVE-2025-12635)
Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is vulnerable to cross-site scripting. This issue has been addressed in this release. Vulnerability...
Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments incorporates Oracle's January 2026 Critical Patch Update (CPU) to fix multiple security vulnerabilities (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)
Summary IBM Storage Protect Data Protection for Virtual Environments incoprporates the security fixes related to Oracle's January 2026 Critical Patch Update CPU. The IBM SDK, Java Technology Edition Critical Patch Update CPU bundles several security updates from Oracle to address multiple...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Prototype Pollution
Summary Lodash is used by IBM Storage Fusion Data Foundation, which could cause Prototype Pollution CVE-2025-13465, CVE-2026-2950, CVE-2026-4800. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Prototype Pollution
Summary Immutable.js is used by IBM Storage Fusion Data Foundation, which could cause Prototype Pollution CVE-2026-29063. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype...
Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in log4j core (CVE-2026-34477, CVE-2026-34478)
Summary IBM Db2 Developer Extension is affected by vulnerability in log4j core CVE-2026-34477, CVE-2026-34478 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificatio...
Security Bulletin: Langflow is affected by security vulnerabilities in Model Context Protocol features
Summary Langflow uses Model Context Protocol MCP features to manage external server connections, project access, file resources, and local client integration. Weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling, and request...
Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to weaker than expected security controls in IBM WebSphere Application Server Liberty (CVE-2025-14923)
Summary IBM Storage Protect Client and Virtual Environments include IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in the Liberty Security Utility could result in weaker than expected security controls during security administration. IBM Storage...
Security Bulletin: IBM Storage Protect Client and Virtual Environments are affected by weaker than expected security in IBM WebSphere Application Server Liberty (CVE-2025-14917)
Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings. IBM Storag...
Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to privilege escalation due to IBM WebSphere Application Server Liberty (CVE-2025-14915)
Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A privilege escalation vulnerability in IBM WebSphere Application Server Liberty, when the restConnector-1.0 or restConnector-2.0 feature is enabled,...
Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to server-side request forgery due to IBM WebSphere Application Server Liberty (CVE-2026-1561)
Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a remote authenticated attacker to perform server-side request forgery SSRF,...
Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-44249)
Summary There is a vulnerability in netty-handler-4.1.133.Final.ja used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In...
Security Bulletin: There is a vulnerability in IBM WebSphere Application Server used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-14915)
Summary There is a vulnerability in IBM WebSphere Application Server used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2025-14915 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server...
Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse http2-common library that could cause resource exhaustion (CVE-2025-5115).
Summary IBM Storage Protect Server uses the Eclipse http2-common library in certain components. A vulnerability in http2-common could cause malicious client to repeatedly send malformed or invalid HTTP/2 frames, forcing the server to generate excessive RSTSTREAM responses. This can result in...
Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server (CVE-2025-36384, CVE-2025-58056, CVE-2024-47072).
Summary IBM Storage Protect Server, which uses IBM Db2, may be affected by multiple vulnerabilities that could result in denial of service or the loss of confidentiality, integrity. These vulnerabilities include CVE-2024-47072, CVE-2025-36442, CVE-2025-36428, CVE-2025-36427, CVE-2025-36424,...
Security Bulletin: IBM Storage Protect Client is vulnerable to denial-of-service attack due to commons-lang-2.6.jar (CVE-2025-48924)
Summary Apache Commons lang 2.6 library is used by the IBM Storage Protect Client, BA Client and Data Protection for VMware component. An uncontrolled recursion flaw in ClassUtils.getClass can cause a StackOverflowError when processing specially crafted long inputs, potentially resulting in a...
Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)
Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to execute arbitrary JavaScript by exploiting insufficient sanitization of href and xlink:href attribut...
Security Bulletin: IBM Storage Protect Client is vulnerable to stored cross-site scripting due to Angular (CVE-2025-66412)
Summary IBM Storage Protect Client uses the Angular web framework to provide web-based user interface components. A stored cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to bypass Angular's built-in security sanitization and execute malicious scrip...
Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-27970)
Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular internationalization i18n pipeline could allow attacker-controlled JavaScript to execute if a malicious translation file is processed. Successful...
Security Bulletin: IBM Storage Protect for Space Management is vulnerable to denial of service due to Apache Tomcat (CVE-2025-46392)
Summary IBM Storage Protect for Space Management uses Apache Tomcat as part of its web application infrastructure. A vulnerability in Apache Tomcat could allow a remote attacker to trigger excessive resource consumption, leading to a denial of service condition. IBM Storage Protect for Space...
Security Bulletin: IBM Storage Protect for Space Management is affected by weaker than expected security in IBM WebSphere Application Server Liberty (CVE-2025-14917)
Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings. IBM Storage Protect...
Security Bulletin: IBM Storage Protect for Space Management is vulnerable to server-side request forgery due to IBM WebSphere Application Server Liberty (CVE-2026-1561)
Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a remote authenticated attacker to perform server-side request forgery SSRF, potentially...
Security Bulletin: IBM Storage Protect for Space Management is vulnerable to denial-of-service attack due to commons-lang-2.6.jar (CVE-2025-48924)
Summary Apache Commons lang 2.6 library is used by the IBM Storage Protect Client, BA Client and Data Protection for VMware component. An uncontrolled recursion flaw in ClassUtils.getClass can cause a StackOverflowError when processing specially crafted long inputs, potentially resulting in a...
Security Bulletin: IBM Storage Protect for Space Management is vulnerable to stored cross-site scripting due to Angular (CVE-2025-66412)
Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A stored cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to bypass Angular's built-in security sanitization and execute malicious scripts...
Security Bulletin: IBM Storage Protect for Space Management is affected by weaker than expected security controls in IBM WebSphere Application Server Liberty (CVE-2025-14923)
Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in the Liberty Security Utility could result in weaker than expected security controls during security administration. IBM Storage Protect for Spa...
Security Bulletin: Security vulnerability has been found in IBM Application Gateway Operator
Summary Security vulnerability has been addressed in IBM Application Gateway Operator Vulnerability Details CVEID:CVE-2026-17617 DESCRIPTION: The IBM Application Gateway Operator is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...
Security Bulletin: Due to IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities.
Summary IBM Db2 vulnerabilities have been found in IBM Cloud Pak System DB2 pattern type db2 pType shipped with Cloud Pak System. Information about security vulnerabilities affecting IBM Db2 have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...
Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization
Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper inpu...
Security Bulletin: Security Vulnerability in Apache Shiro affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-49268)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed a vulnerability caused by Apache Shiro. Vulnerability Details CVEID:CVE-2026-49268 DESCRIPTION: A remote attacker can inject LDAP special characters into the Distinguished Name DN construction in DefaultLdapRealm...
Security Bulletin: IBM Storage Protect Server is susceptible to vulnerabilities due to Golang library related to ObjectAgent(CVE-2026-39824).
Summary Golang library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang is affected by multiple vulnerabilities that may cause data integrity issues, or memory handling problems when processing specially crafted input. This bulletin identifies the steps to address...