Security Bulletin: Multiple security vulnerabilities have been identified in Python packages shipped with IBM Guardium Cryptography Manager (GCM)

Summary Multiple security vulnerabilities identified in Python packages shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-48775 DESCRIPTION: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Immutable.js

Summary IBM DataPower Gateway affected by multiple CVEs in Immutable.js Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Listset, ListsetSize, ListsetIn, ListupdateIn, and the functional set, setIn,...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)

Summary IBM DataPower Gateway has addressed CVE-2026-66010 in 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...

Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in the third party libraries shipped with IBM Guardium Cryptography Manager GCM have been addressed. Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions...

Security Bulletin: Due to the use of IBM Semeru Runtime, IBM DataPower Gateway is affected by multiple vulnerabilities

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in IBM Semeru Runtime in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow chec...

Security Bulletin: Threat Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Threat Intelligence App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in qs

Summary Multiple vulnerabilities were addressed in IBM DataPower Gateway versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-82417 DESCRIPTION: Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callab...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in xmldom

Summary Multiple vulnerabilities were addressed in IBM DataPower Gateway version 11.0.0.3 Vulnerability Details CVEID:CVE-2026-83605 DESCRIPTION: xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and...

Security Bulletin: The Use Case Manager App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Use Case Manager App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify befo...

Security Bulletin: IBM DataPower Gateway affected by request smuggling due to form-data (CVE-2026-12143)

Summary IBM DataPower Gateway addressed CVE-2026-12143 in form-data in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in http-proxy-middleware

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in http-proxy-middleware in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0,...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs

Summary IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-16177 DESCRIPTION: IBM DataPower Gateway could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 Vulnerability Details CVEID:CVE-2026-41710 DESCRIPTION: An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache ...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i

Summary IBM Rational Developer for i is affected by cross-site scripting vulnerabilities in DOMPurify CVE-2026-65898, CVE-2026-65900, CVE-2026-65901, CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, CVE-2026-66010, and CVE-2026-75838, a protection mechanism failure vulnerability in DOMPurify...

Security Bulletin: IBM® Db2® could allow a authenticated attacker to cause a denial of service due to uncontrolled resource consumption (CVE-2026-17463)

Summary IBM® Db2® could allow a authenticated attacker to cause a denial of service due to uncontrolled resource consumption CVE-2026-17463 Vulnerability Details CVEID:CVE-2026-17463 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2...

Security Bulletin: IBM WebSphere Application Server - Liberty is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty is shipped as a supporting program of IBM OpenPages. Information about multiple vulnerabilities affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. These products have addressed the applicable CVEs. For a...

Security Bulletin: Multiple perl vulnerabilities impact AIX.

Summary Vulnerabilities in Perl could cause Information DisclosureCVE-2026-57432, Heap Buffer OverflowCVE-2026-8376, Regex Validation BypassCVE-2026-13221, Host Validation BypassCVE-2026-19953, Out-of-Bounds Read/Write CVE-2026-15534, Access Control BypassCVE-2026-19487. Vulnerability Details...

Security Bulletin: Multiple Security Vulnerabilities in Apache HttpComponents Client affect IBM Content Navigator

Summary Apache HttpComponents Client is affected by two vulnerabilities CVSS up to 9.1, Critical. CVE-2026-71290 CVSS 9.1 is an improper TLS hostname verification flaw in the async HttpClient versions 5.4 and later where HostnameVerificationPolicyBUILTIN has no effect, allowing a network attacker...

Security Bulletin: IBM Storage Protect Server is vulnerable to unauthenticated attacker with network access via multiple protocols and TLS due to IBM SDK, Java (CVE-2025-50106, CVE-2025-30749, CVE-2025-30761, CVE-2025-30754)

Summary IBM SDK, Java is vulnerable to unauthenticated attacker with network access via multiple protocols and TLS, IBM Storage Protect Server uses IBM SDK, Java and may be affected by this vulnerability. Vulnerability Details CVEID:CVE-2025-50106 DESCRIPTION: Vulnerability in the Oracle Java SE,...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 13 and 5.4.0 before Patch 6. Vulnerability Details CVEID:CVE-2026-45623 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and modify its rules by...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in nanoid (CVE-2026-67213, CVE-2026-67214)

Summary Multiple vulnerabilities in the nanoid generator library CVE-2026-67213, CVE-2026-67214 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.3.17. Vulnerability Details CVEID:CVE-2026-67213 DESCRIPTION: nanoid Nano ID before 5.1.6 contain...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in Apache Thrift (CVE-2026-41608, CVE-2026-66053)

Summary Multiple Denial of Service vulnerabilities in Apache Thrift CVE-2026-41608, CVE-2026-66053 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.24.0. Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540)

Summary Multiple Denial of Service and resource exhaustion vulnerabilities in the python-multipart parser library CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in ws (CVE-2026-62389)

Summary A Denial of Service vulnerability in the ws WebSocket client/server library CVE-2026-62389 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 8.21.1. Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in idna (CVE-2026-45409)

Summary A Denial of Service vulnerability in the idna domain label parsing library CVE-2026-45409 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.18. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Names in...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in axios (CVE-2026-42264)

Summary A credential exposure vulnerability during HTTP redirects in the axios HTTP client library CVE-2026-42264 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise...

Security Bulletin: Impacted IBM Optim for z/OS 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in jackc/Pgx, cloudflare/cfSSL, x/net

Summary IBM Optim for z/OS version 1.0.0, 1.1.0 and 1.2.0 depends on open-source packages jackc/Pgx, cloudflare/cfSSL and x/net which are affected by medium, high and critical severity vulnerabilities. IBM Optim for z/OS 2.0.0 resolves these vulnerabilities by upgrading the affected open-source...

Security Bulletin: IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities (CWE-22)

Summary IBM Optim Test Data Management versions 1.0.0, 1.1.0, and 1.2.0 are affected by three medium-severity vulnerabilities including File Path Traversal, Abuse of Functionality with No Rate Limiting, and Weak Password Policy. IBM Optim Test Data Management 2.0.0 resolves these vulnerabilities ...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities (CVE-2026-19032, CVE-2026-83557)

Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION:...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION:...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in aircompressor, libarchive, gstreamer1, LIBPNG, bind9, giflib, react-router, dompurify

Summary IBM Optim version 1.0.0, 1.1.0 and 1.2.0 depends on open-source packages aircompressor, libarchive, gstreamer1, LIBPNG, bind9, giflib, react-router, dompurify which are affected by medium, high and critical severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by...

Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library

Summary Multiple vulnerabilities related to Jackson Databind library were addressed for IBM Engineering Systems Design Rhapsody. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.325 Vulnerability Details CVEID:CVE-2026-5450 DESCRIPTION: Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK (August 2026) affect IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK security updates in August 2026. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION:...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities. CVE-2026-10841, CVE-2026-11548, CVE-2026-11549, CVE-2026-11722, CVE-2026-15396, CVE-2026-15412, CVE-2026-15634 Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: Security Vulnerabilities in Third-Party Node.js Packages Used by IBM Rhapsody Systems Engineering

Summary Security vulnerabilities were identified in the product's Node.js dependencies. The issue has been mitigated by removing the vulnerable packages and updating dependencies to secure versions. Vulnerability Details CVEID:CVE-2026-29087 DESCRIPTION: @hono/node-server allows running the Hono...

Security Bulletin: jackson-mapper vulnerability addressed in IBM Big Replicate LiveData Migrator 3.4

Summary jackson-mapper vulnerability addressed in IBM Big Replicate LiveData Migrator Vulnerability Details CVEID:CVE-2019-10172 DESCRIPTION: A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehau...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-56339 DESCRIPTION: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker...

Security Bulletin: The Analyst Workflow App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Analyst Workflow App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-73646 DESCRIPTION: PostCSS takes ...

Security Bulletin: QRadar Deployment Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. QRadar Deployment Intelligence for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axio...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2024-57849 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: s390/cpumsf: Handle CPU hotplug remove during sampling CPU hotplug remove handling...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift:...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core

Summary IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to IBM Java (CVE-2026-16440)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to IBM Java. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation...

Security Bulletin: The Pre-Validation App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Pre-Validation App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33750 DESCRIPTION: The...

Security Bulletin: IBM App Connect Enterprise is affected by multiple vulnerabilities in Eclipse Jetty.

Summary IBM App Connect Enterprise Toolkit is affected by multiple vulnerabilities in Eclipse Jetty. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Java SDK ( CVE-2026-61308, CVE-2026-70907 & CVE-2026-60589)

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Java SDK. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime.

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...