Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a cross-site request forgery (CVE-2026-14980, CVE-2026-2482)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a cross-site request forgery vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a cross-site request forgery (CVE-2026-14980, CVE-2026-2482)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a cross-site request forgery vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a cross-site request forgery (CVE-2026-14980, CVE-2026-2482)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a cross-site request forgery vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes sectio...

Security Bulletin: IBM Db2 Bridge is vulnerable due to Jackson-databind ( CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518)

Summary Jackson databind is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5 and new Fix pack was release to address the issue. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation (CVE-2026-14446)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by a privilege escalation (CVE-2026-14446)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed i...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528)

Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Version...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation (CVE-2026-14446)

Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to CVE-2026-2332.

Summary IBM Maximo Application Suite - IoT Component uses jetty-http-10.0.26.jar, jetty-http-12.1.5.jar, jetty-http-12.1.6.jar which is vulnerable to CVE-2026-2332. This bulletin contains information regarding the vulnerability and how to address it. Vulnerability Details CVEID:CVE-2026-2332...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses go.mongodb.org/mongo-driver-v1.12.0 which is vulnerable to CVE-2026-2303

Summary IBM Maximo Application Suite - Visual Inspection component uses go.mongodb.org/mongo-driver-v1.12.0 which is vulnerable to CVE-2026-2303, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/sys-v0.38.0 which is vulnerable to CVE-2026-39824.

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/sys-v0.38.0 which is vulnerable to CVE-2026-39824. This bulletin contains information regarding the vulnerability and its remediation Vulnerability Details CVEID:CVE-2026-39824 DESCRIPTION: NewNTUnicodeString doe...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar which is vulnerable to CVE-2026-53655

Summary IBM Maximo Application Suite - Visual Inspection component uses tar which is vulnerable to CVE-2026-53655, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-53655 DESCRIPTION: node-tar is a full-featured Tar for Node.j...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses postcss-selector-parser-7.1.1.tgz which is vulnerable to CVE-2026-9358

Summary IBM Maximo Application Suite - Visual Inspection component uses postcss-selector-parser-7.1.1.tgz which is vulnerable to CVE-2026-9358, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-9358 DESCRIPTION: A vulnerabilit...

Security Bulletin:Erlang OTP SSH Path Traversal Vulnerability Affects File Attribute Modification and Privilege Escalation

Summary Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon sshsftpd stores the raw, user-supplied path in...

Security Bulletin:IP-Address Library Vulnerability: XSS Risk with Untrusted Input Rendering and HTML Escaping Issues

Summary ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage emitted by the...

Security Bulletin:QS.stringify TypeError with arrayFormat: comma and encodeValuesOnly:true on null/undefined Arrays

Summary Summary qs.stringify throws TypeError when called with arrayFormat: 'comma' and encodeValuesOnly: true on an array containing null or undefined. The throw is synchronous and not handled by any of qs's null-related options skipNulls, strictNullHandling. Details In the comma +...

Security Bulletin:Pillow Integer Overflow Vulnerability Fixed in Version 12.2.0

Summary Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0. Vulnerability Details...

Security Bulletin:Cross-Origin Redirect Headers Vulnerability in urllib3 Prior to 2.7.0

Summary urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl.urlopen..., assertsamehost=False still forward these sensitive headers. This vulnerability is fixed in 2.7.0. Vulnerability...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2026-14529)

Summary WebSphere Application Server is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-14529 DESCRIPTION: IBM...

Security Bulletin:IDNA for Python Vulnerability: Resource Consumption and Denial-of-Service Risk with Long Inputs

Summary Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the validcontexto...

Security Bulletin:UltraJSON Memory Leak Fix in ujson.dump() Prior to 5.12.1

Summary UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write...

Security Bulletin:PyJWT CVE-2023-40254: Local File Inclusion & Server-Side Request Forgery via PyJWKClient uri Argument

Summary PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently...

Security Bulletin:Catastrophic Backtracking Vulnerability in path-to-regexp with Three or More Parameters

Summary Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

Security Bulletin:Mako Template Library Vulnerability: Backslash Traversal on Windows Prior to Version 1.3.12

Summary Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal e.g. \..\..\ secret.txt bypasses the directory traversal check in Template.init and the posixpath-based normalization in TemplateLookup.gettemplate, allowing reads of files outside...

Security Bulletin:lxml Local File Access Vulnerability: Fixed in 6.1.0

Summary lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration with resolveentities=True allows untrusted XML input to read local files. Setting the resolveentities option explicitly to...

Security Bulletin:DNS Name Constraints Validation Issue Fixed in cryptography v46.0.6

Summary cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently,...

Security Bulletin:Pallets Click 8.3.2 Command Injection Vulnerability

Summary Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands from an unprivileged account. Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions 8.3.2 and below,...

Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.

Summary There are vulnerabilities in the jackson-databind jar used by IBM APM Linux KVM Agent for Virtual Environments. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI (CVE-2026-59879, CVE-2026-59880)

Summary IBM Tivoli Netcool/OMNIbus WebGUI includes the Immutable.js library for persistent immutable data structures used in the client-side UI. Vulnerabilities have been identified in this library that could affect the product. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...

Security Bulletin: Multiple vulnerabilities in IBM Aspera HTTP Gateway

Summary Multiple vulnerabilities were addressed in IBM Aspera HTTP Gateway version 2.3.4 Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. The C wrapper implementation contains a heap...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14512, CVE-2026-14528)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14446)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14529)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM QRadar SIEM is vulnerable to remote code execution by privileged users

Summary An authenticated QRadar SIEM administrator can execute arbitrary commands on the QRadar host due to improper validation of user supplied input. Vulnerability Details CVEID:CVE-2026-13477 DESCRIPTION: QRadar could allow an authenticated privileged user to execute arbitrary commands with...

Security Bulletin: IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability

Summary IBM QRadar has an XML External Entity XXE injection vulnerability. This vulnerability is not exploitable in all configurations. All of the following conditions must be simultaneously true for a system to be at risk: 1 XML Property Autodetection must be actively enabled on at least one log...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses jetty-http-10.0.26.jar, jackson-databind-2.22.0.jar, postgresql-42.7.11.jar, kafka-clients-3.9.1.jar which is vulnerable to CVE-2025-11143, CVE-2026-59889, CVE-2026-54291,CVE-2026-33558. This bulletin contains information regarding the...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses HdrHistogram-2.1.12.jar which is vulnerable to CVE-2026-14683, CVE-2026-14684, CVE-2026-14685, CVE-2026-14686. This bulletin contains information regarding the vulnerability and how to address it. Vulnerability Details CVEID:CVE-2026-14683...

Security Bulletin: Due to the use of jackson-databind, IBM EntireX is vulnerable to multiple vulnerabilities.

Summary Due to the use of jackson-databind, IBM EntireX is vulnerable to multiple vulnerabilities CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-59888, and CVE-2026-59889. To address these vulnerabilities, the webMethods...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra Reaper 4.0

Summary IBM Sterling Global Availability Mailbox uses Cassandra Reaper 4.0, which is affected by privilege escalation CVE-2026-27314 and resource consumption CVE-2026-32588 vulnerabilities. Vulnerability Details CVEID:CVE-2026-27314 DESCRIPTION: Privilege escalation in Apache Cassandra 5.0 on an...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra 4.0

Summary Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8....

Security Bulletin: IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

Summary IBM Maximo Application Suite uses axios-1.15.2.tgz, protobufjs-8.0.1.tgz, protobufjs-8.2.0.tgz and undici-7.26.0.tgz which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-6734, CVE-2026-9678, CVE-2026-9679, CVE-2026-9697, CVE-2026-54270, CVE-2026-45740,...