37794 matches found
Security Bulletin: Resolved XSS vulnerability in DOMPurify (CVE-2026-75838)
Summary Carbon Charts has updated its DOMPurify dependency from ^3.4.12 to ^3.4.14, resolving CVE-2026-75838 Medium, CVSS 5.4 — an XSS vulnerability caused by improper INPLACE sanitization in DOMPurify versions prior to 3.4.13. The vulnerability affects the sanitize API used internally by Carbon...
Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Quarkus Core Security, SmallRye JWT, Hibernate and WebSockets.next Vulnerability Details CVEID:CVE-2026-87743 DESCRIPTION: A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in...
Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to Java SDK
Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Java and are addressed in version 6.1.0.5 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromis...
Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS
Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities CVE-2026-13505, CVE-2026-9563 in Bouncy Castle for Java FIPS and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X...
Security Bulletin: A vulnerability in OpenSSL affects IBM Rational ClearQuest (CVE-2025-66199)
Summary An OpenSSL vulnerability was disclosed by the OpenSSL Project. OpenSSL is used by IBM Rational ClearQuest. IBM Rational ClearQuest has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-66199 DESCRIPTION: Issue summary: A TLS 1.3 connection using certificate compression ca...
Security Bulletin: Vulnerabilities in WebSphere Liberty profile(CVE-2026-14525, CVE-2026-16192, CVE-2026-10571, CVE-2026-14976, CVE-2026-15280, CVE-2026-18499, CVE-2026-14980, CVE-2026-2482, CVE-2026-14529, CVE-2026-10841) affect Power PowerVM Novalink
Summary The WebSphere Liberty profile used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-10571 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure...
Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)
Summary extract-zip through 2.0.1 only checks the parent directory of each archive entry, allowing a symlink-then-regular-file pair with identical names to write through the planted symlink and achieve arbitrary file write outside the destination directory. CVSS: 8.1 High, CWE-22. Vulnerability...
Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)
Summary extract-zip 2.0.1 does not validate symlink targets during zip extraction, allowing a malicious archive with relative symlink paths to read or write arbitrary files outside the extraction directory. CVSS: 8.1 High, CWE-22. Vulnerability Details CVEID:CVE-2026-56876 DESCRIPTION: extract-zi...
Security Bulletin: IBM Guardium Data Protection is affected by security vulnerability (CVE-2026-43869)
Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-43869 DESCRIPTION: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended ...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-42508 DESCRIPTION: Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and...
Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .
Summary IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat. The Tomcat version has been updated within IBM ApplinX in order to address the mentioned vulnerabilities. Vulnerability Detail...
Security Bulletin: Due to the use of Bouncy Castle cryptographic libraries, IBM EntireX is vulnerable to multiple vulnerabilities.
Summary Due to the use of Bouncy Castle cryptographic libraries including bctls-fips, bc-fips, bcpkix-jdk18on, and bcprov-jdk18on, IBM EntireX is vulnerable to Improper Validation of Certificate with Host Mismatch, Memory Allocation with Excessive Size Value, Uncontrolled Recursion, Allocation of...
Security Bulletin: IBM Transformation Extender Advanced is affected by multiple Java vulnerabilities.
Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is affected by multiple vulnerabilities because it is dependent on Java. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut...
Security Bulletin: Due to the use of Bouncy Castle for Java, IBM Sterling Control Center is vulnerable to Memory Allocation, Improper Validation, Inadequate Encryption Strength, Inefficient Algorithmic Complexity and LDAP Injection.
Summary Bouncy Castle for Java is used by IBM Sterling Control Center as part of dependency in bcprov-jdk18on-1.81.jar Vulnerability Details CVEID:CVE-2026-12185 DESCRIPTION: In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This iss...
Security Bulletin: Due to the use of Bouncy Castle for Java, IBM Sterling Control Center is vulnerable to Uncontrolled Recursion(CVE-2026-59645)
Summary Bouncy Castle for Java is used by IBM Sterling Control Center as part of dependency in bcutil-jdk18on-1.81.jar Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. Thi...
Security Bulletin: Due to the use of Apache ActiveMQ All, IBM Sterling Control Center is vulnerable to Improper Authorization and Improper Input Validation (CVE-2026-59878, CVE-2026-61487)
Summary Apache ActiveMQ All is used by IBM Sterling Control Center as part of dependency in activemq-all-5.19.0.jar. Vulnerability Details CVEID:CVE-2026-59878 DESCRIPTION: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote...
Security Bulletin: Due to the use of Apache HttpComponents Client 5.4, IBM Sterling Control Center is vulnerable to Improper Certificate Validation (CVE-2026-71290)
Summary Apache HttpComponents Client 5.4 is used by IBM Sterling Control Center as part of dependency in httpclient5-5.4.3.jar. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer...
Security Bulletin: Vulnerabilities in IBM SDK, Java Technology (CVE-2026-16440, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589) affect Power PowerVM Novalink
Summary The IBM SDK, Java Technology used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...
Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub
Summary The following dependency packages are being used by IBM Db2 Genius Hub - node-fetch-3.1.1.tgz, Jinja2-3.0.3-py3-none-any.whl, dompurify-3.4.11.tgz, react-router-6.30.4.tgz, react-router-dom-6.30.4.tgz, brace-expansion-5.0.8.tgz, browserslist-4.26.2.tgz, baseline-browser-mapping-2.10.38.tg...
Security Bulletin: Security Vulnerability identified in jsoup used by IBM Maximo Application Suite - MREF ( CVE-2026-75140 )
Summary There is a vulnerability in jsoup-1.23.1.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-75140 DESCRIPTION: jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and...
Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2026-49844).
Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This...
Security Bulletin: IBM App Connect Enterprise is vulnerable to Code Injection due to Node.js module jsonata (CVE-2026-12208)
Summary IBM App Connect Enterprise Discovery Connectors is vulnerable to Code Injection due to Node.js module jsonata. Vulnerability Details CVEID:CVE-2026-12208 DESCRIPTION: A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the...
Security Bulletin: Multiple Vulnerabilities in IBM Concert Software
Summary Multiple vulnerabilities were addressed in IBM Concert Software version 3.0.1.1 Vulnerability Details CVEID:CVE-2026-27794 DESCRIPTION: LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and...
Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench
Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.2 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-41417 DESCRIPTION: Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via...
Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)
Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with jaxws-2.2, xmlWS-3.0, xmlWS-4.0, wsSecurity-1.1 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in libxml2
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package libxml2 that is affected by three critical-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details...
Security Bulletin: Vulnarabilities in kernel, glibc, expat, RMC daemon, httpd and mod_http2 libraries (CVE-2026-46333, CVE-2026-4046, CVE-2026-45186, CVE-2026-14514, CVE-2025-53020, CVE-2026-49975) affect Power HMC.
Summary The kernel, glibc, expat, RMC daemon, httpd and modhttp2 libraries are used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash d...
Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a...
Security Bulletin: Vulnerabilities in Apache Tomcat Server library (CVE-2026-59083, CVE-2026-55956) affect Power HMC.
Summary The Apache Tomcat Server library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security...
Security Bulletin: Vulnerabilities in xorg-x11-server library (CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50264, CVE-2026-59083, CVE-2026-55999) affect Power HMC.
Summary The xorg-x11-server is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-55999 DESCRIPTION: Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before...
Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)
Summary There is a vulnerability in the Apache Neethi library that affects IBM WebSphere Application Server Liberty with the jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...
Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities
Summary The vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION:...
Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities
Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-75899...
Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials
Summary Security vulnerabilities have been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a secon...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-1285 DESCRIPTION: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. django.utils.text.Truncator.chars and...
Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-73646 DESCRIPTION: PostCSS...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerability in github.com/slackhq/nebula package
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerability in github.com/slackhq/nebula package. IBM optim 1.2.0 resolves this vulnerability by upgrading the package from vulnerable version Vulnerability Details CVEID:CVE-2026-25793 DESCRIPTION: Nebula is a scalable overlay networking...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the package bind9.18-libs, bind9.18-utils.
Summary Impacted IBM optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the package bind9.18-libs, bind9.18-utils. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-1519 DESCRIPTION: If a BIND...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in jackc/pgx
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package jackc/pgx that is affected by a critical-severity vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected open-source dependency to fixed version. Vulnerability Details CVEID:CVE-2026-338...
Security Bulletin: Impacted IBM Optim 1.2.0 by vulnerabilities in scrapy
Summary IBM Optim version 1.2.0 depends on an open-source package scrapy which is affected by a high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details CVEID:CVE-2025-6176 DESCRIPTION:...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 impacted by a denial of service vulnerability in axios
Summary axios is used by IBM Optim as part of its front-end user interface for making HTTP requests from the browser. CVE-2026-25639, A denial of service vulnerability exists in axios prior to versions 0.30.3 and 1.13.5, where the mergeConfig function crashes with a TypeError when processing a...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerabilities in crypto/x509 package.
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerabilities in crypto/x509 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2025-61729 DESCRIPTION: Within HostnameError.Error,...
Security Bulletin: IBM Optim 1.1.0 impacted by vulnerability in lodash-es 4.17.21
Summary IBM Optim 1.1.0 includes lodash-es 4.17.21 as an npm dependency in the archon-ui component. This version is affected by CVE-2025-13465, a prototype pollution vulnerability that allows a remote attacker to manipulate JavaScript object prototypes via specially crafted input, potentially...
Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1
Summary webkit2gtk3-jsc, gstreamer1-plugins-base, libtiff, and giflib are bundled with IBM Optim as part of its base OS image; Eclipse Jetty jetty-io is used for HTTP server infrastructure; Apache ZooKeeper zookeeper is used for distributed coordination; Jackson Core jackson-core is used for JSON...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 ,1.2.0 by vulnerabilities in the package google.golang.org/grpc
Summary Impacted IBM optim 1.0.0, 1.1.0 ,1.2.0 by vulnerabilities in the package google.golang.org/grpc. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by a vulnerability in Go's HTTP/2 transport
Summary BM Optim versions 1.0.0, 1.1.0, and 1.2.0 include the Go net/http package, which is affected by a high-severity denial-of-service vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected Go dependency to a fixed version. Vulnerability Details CVEID:CVE-2026-338...