Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple security vulnerabilities in Apache components that could allow denial of service, excessive resource consumption, application crashes, or unauthorized outbound requests.

Summary IBM Tivoli Netcool Configuration Manager version 6.4.2 addresses multiple vulnerabilities in Apache components. These vulnerabilities could allow attackers to cause denial of service, excessive resource consumption, application crashes, or trigger unauthorized outbound requests through...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in golang.org/x/text.

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in golang.org/x/text. CVE-2026-56852 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-56852 DESCRIPTION: A norm.Iter can enter an infinite loop when handli...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in fast-uri

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in fast-uri. CVE-2026-16221 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 includin...

Security Bulletin: IBM QRadar Suite Software includes components with multiple known vulnerabilities

Summary IBM QRadar Suite Software includes components with multiple known vulnerabilities. These have been addressed in the update. Vulnerability Details CVEID:CVE-2026-8723 DESCRIPTION: Summary qs.stringify throws TypeError when called with arrayFormat: 'comma' and encodeValuesOnly: true on an...

Security Bulletin: Vulnerability in WebSphere Application Server Liberty affect Cloud Pak System Pattern Type

Summary Denial of service vulnerability affects WebSphere Application Server Liberty which is bundled as WebSphere Application Server liberty pattern type with IBM Cloud Pak System CVE-2026-9563 Vulnerability Details CVEID:CVE-2026-9563 DESCRIPTION: In Eclipse Parsson published Maven Central...

Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data.

Summary There are multiple vulnerabilities impacting IBM Watson Studio in Cloud Pak for Data. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-61729 DESCRIPTION: Within HostnameError.Error, when constructing an error string, there is ...

Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service

Summary Multiple vulnerabilities have been addressed in components of VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c...

Security Bulletin: Multiple vulnerabilities affect IBM Sterling Connect:Direct File Agent

Summary There are vulnerabilities in IBM Semeru Runtime version 17 used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable CVEs CVE-2026-41254, CVE-2026-47063, CVE-2026-60147, CVE-2026-46968, CVE-2026-47027, CVE-2026-47021, CVE-2026-4691...

Security Bulletin: IBM Jazz for Service Management is affected by multiple vulnerabilities in Apache ActiveMQ

Summary IBM Jazz for Service Management is affected by multiple vulnerabilities in Apache ActiveMQ CVE-2026-59878, CVE-2026-61487 Vulnerability Details CVEID:CVE-2026-59878 DESCRIPTION: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.3.1 Patch 11 Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrif...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)

Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94:...

Security Bulletin: MaaS360 mobile apps (iOS and Android) are able to bypass authentication by using deep link from the browser.

Summary MaaS360 mobile apps iOS and Android are able to bypass authentication by using deep link from the browser. Vulnerability Details CVEID:CVE-2023-42021 DESCRIPTION: The MaaS360 iOS application could allow an attacker to bypass authentication mechanisms by exploiting the password reset...

Security Bulletin: IBM SPSS Analytic Server is affected by Uncontrolled Recursion vulnerability in Apache Commons

Summary IBM SPSS Analytic Server is affected by Uncontrolled Recursion vulnerability in Apache Commons. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in IBM Semeru Runtime

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in IBM Semeru Runtime. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

Summary IBM i is vulnerable to denial of service CVE-2026-11897, CVE-2026-15057, CVE-2026-14981, CVE-2026-64958, CVE-2026-57819, CVE-2026-54225, HTTP response smuggling CVE-2026-15064, CVE-2026-15328, CVE-2026-15325, and bypassing of security constraints CVE-2026-10842 in WebSphere Application...

Security Bulletin: IBM i is Affected By Holding Resources after Effective Lifetime Vulnerability in Electronic Service Agent [CVE-2026-64607]

Summary Electronic Service Agent for IBM i uses HttpClient for HTTP message handling. HttpClient is vulnerable to not releasing underlying resources when encountering an invalid or unsupported 'Content-Encoding' header value CVE-2026-64607 as described in the vulnerability details section...

Security Bulletin: IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [CVE-2026-18527, CVE-2026-17203].

Summary IBM Application Runtime Expert ARE for IBM i is vulnerable to a user gaining elevated privileges due to ARE GUI component processing CVE-2026-18527 and allow an attacker to obtain sensitive information CVE-2026-17203 as described in the vulnerability details section. Vulnerability Details...

Security Bulletin: IBM Transformation Extender Advanced is affected by IBM WebSphere Application Server Liberty vulnerabilities

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is vulnerable to IBM WebSphere Application Server Liberty's HTTP request smuggling CVE-2026-8646 and denial of service vulnerabilities CVE-2026-9320, CVE-2026-9071 Vulnerability Details Refer to the...

Security Bulletin: IBM SPSS Modeler is affected by an arbitrary code execution vulnerability in Logback Core

Summary IBM SPSS Modeler is affected by an arbitrary code execution vulnerability in Logback Core. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-13006 DESCRIPTION: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up t...

Security Bulletin: This Power System update is being released to address CVE-2026-19234

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...

Security Bulletin: IBM SPSS Modeler is affected by a cryptographic vulnerability in Apache Tink

Summary IBM SPSS Modeler is affected by a cryptographic vulnerability in Apache Tink. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-15432 DESCRIPTION: When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Eclipse Jetty

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Eclipse Jetty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2024-7708 DESCRIPTION: For requests that have a body, but reading the body may end up in reading 0 bytes...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.2 Vulnerability Details CVEID:CVE-2022-40152 DESCRIPTION: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user suppli...

Security Bulletin: This Power System update is being released to address CVE-2026-17494

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system, giving full control over the host system...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-53666 DESCRIPTION: React Router is a router for React. In versions 6.4.0 through 7.17.0, if...

Security Bulletin: This Power System update is being released to address CVE-2026-16933

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can read and write arbitrary regions of host system memory, giving full control over the host system and all hoste...

Security Bulletin: This Power System update is being released to address CVE-2026-17063

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions,...

Security Bulletin: This Power System update is being released to address CVE-2026-17429

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted...

Security Bulletin: This Power System update is being released to address CVE-2026-16930

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions,...

Security Bulletin: This Power System update is being released to address CVE-2026-19321

Summary Power Systems Firmware is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers that should be inaccessible to the service processor. Successful...

Security Bulletin: Vulnerabilities in IBM AIX and PowerVM VIOS

Summary Updated Aug 21, 2026: Updated the summary to highlight the additional installation instructions. IBM is providing security updates for supported AIX and VIOS releases that are under active fix support. Delivered through Service Packs SPs and Fix Packs FPs, these updates remediate...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026)

Summary Axios is vulnerable to Prototype Pollution / Transport Hijacking ,HTTP Request/Response Splitting via Gadget ,NOPROXY Protection Bypass ,Denial of Service DoS via Uncontrolled Recursion ,SSRF via Incomplete Proxy Bypass ,JSON API Response Manipulation via Prototype Pollution,XSRF Token...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2025-62718, CVE-2026-40175)

Summary Axios is vulnerable to infrastructure tampering and Critical SSRF and exposure of private internal/loopback endpoints attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser an...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2025-62718)

Summary Axios is vulnerable to proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to axios-1.12.2.tgz (CVE-2026-25639, CVE-2026-39865)

Summary Axios is vulnerable to a Improper Check for Unusual or Exceptional Conditions Complete Denial of Service DoS, Uncontrolled Resource Consumption forcefully crashing the client application backend attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Handlebars (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)

Summary Handlebars is vulnerable to Code Injection ,Improper Check for Unusual or Exceptional Conditions and Cross-site Scripting attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-33937 DESCRIPTION: Handlebars provides the power necessary to let user...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to multer-2.0.1.tgz (CVE-2025-7338 ,CVE-2026-2359 ,CVE-2026-3304 ,CVE-2026-3520)

Summary multer is vulnerable to Uncaught Exception,Missing Release of Resource after Effective Lifetime,Incomplete Cleanup,Uncontrolled Recursion attacks. These vulnerabilities affect IBM Spectrum Control Vulnerability Details CVEID:CVE-2025-7338 DESCRIPTION: Multer is a node.js middleware for...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to picomatch-2.2.2.tgz (CVE-2026-33671, CVE-2026-33672)

Summary picomatch is vulnerable to a Inefficient Regular Expression Complexity DOS, Improperly Controlled Modification of Object Prototype Attributes / Prototype Reference attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to immutable-4.3.5.tgz (CVE-2026-29063)

Summary Immutable is vulnerable to a Prototype Pollution attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Zlib (CVE-2026-3381)

Summary Zlib is vulnerable to Remote Code Execution ,Denial of Service DoS, Arbitrary File/Data Overwrite, Sensitive Information Disclosure attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-3381 DESCRIPTION: Compress::Raw::Zlib versions through 2.219...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to multer-1.4.2.tgz (CVE-2026-3520)

Summary Multer is vulnerable to DOS attack. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-3520 DESCRIPTION: Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to multer-1.4.2.tgz (CVE-2025-47935, CVE-2026-2359, CVE-2026-3304)

Summary Multer is vulnerable to Missing Release of Memory after Effective Lifetime, Missing Release of Resource after Effective Lifetime, Incomplete Cleanup attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-47935 DESCRIPTION: Multer is a node.js...

Security Bulletin: IBM Spectrum Control is vulnerable to a weaknesses related to pdfmake-0.2.10.tgz (CVE-2025-11362)

Summary Pdfmake is vulnerable to a Allocation of Resources Without Limits or Throttling attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-11362 DESCRIPTION: Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to dojo.profile-1.9.7.js (CVE-2021-23450, CVE-2008-6681, CVE-2010-2273)

Summary dojo.profile is vulnerable to Prototype Pollution flaw, Cross-Site Scripting XSS attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2021-23450 DESCRIPTION: All versions of package dojo are vulnerable to Prototype Pollution via the setObject functio...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to IBM SDK, Java Technology Edition Quarterly CPU - Oct 2024 (CVE-2024-21235,CVE-2024-21217,CVE-2024-21210,CVE-2024-21208,CVE-2024-10917)

Summary IBM SDK, Java Technology Edition Quarterly CPU - Oct 2024 is vulnerable to a Side-Channel / Data Tampering Logic Errors , Deserialization of Untrusted Data , Observable Discrepancy , Integer Overflow or Wraparound attacks. This vulnerability affects IBM Spectrum Control. Vulnerability...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to IBM WebSphere Application Server Liberty (CVE-2024-40094)

Summary IBM WebSphere Application Server Liberty is vulnerable to denial of service attack. These vulnerabilities affect IBM Spectrum Control Vulnerability Details CVEID:CVE-2024-40094 DESCRIPTION: GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENF...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to qs-6.13.0.tgz (CVE-2026-2391)

Summary qs is vulnerable to a Improper Input Validation attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for comma-separated values when comma: true is enabled, allowing...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to IBM WebSphere Application Server Liberty (CVE-2025-14914)

Summary Immutable is vulnerable to a Path Traversal / "Zip Slip" attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-14914 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archiv...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to axios-1.12.2.tgz (CVE-2026-25639)

Summary Immutable is vulnerable to a Denial of Service attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function i...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to IBM SDK, Java Technology Edition Quarterly CPU - Jan 2026 (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)

Summary IBM SDK, Java Technology Edition Quarterly CPU - Jan 2026 is vulnerable to a Uncontrolled Resource Consumption, Security Control Bypass, Low-Impact High-Complexity Data Bypass attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION:...