Security Bulletin: IBM Storage Protect for Space Management is affected by weaker than expected security controls in IBM WebSphere Application Server Liberty (CVE-2025-14923)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in the Liberty Security Utility could result in weaker than expected security controls during security administration. IBM Storage Protect for Spa...

Security Bulletin: Security vulnerability has been found in IBM Application Gateway Operator

Summary Security vulnerability has been addressed in IBM Application Gateway Operator Vulnerability Details CVEID:CVE-2026-17617 DESCRIPTION: The IBM Application Gateway Operator is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

Security Bulletin: Due to IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary IBM Db2 vulnerabilities have been found in IBM Cloud Pak System DB2 pattern type db2 pType shipped with Cloud Pak System. Information about security vulnerabilities affecting IBM Db2 have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper inpu...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerabilities due to Golang library related to ObjectAgent(CVE-2026-39824).

Summary Golang library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang is affected by multiple vulnerabilities that may cause data integrity issues, or memory handling problems when processing specially crafted input. This bulletin identifies the steps to address...

Security Bulletin: IBM Storage Protect Server is affected by multiple vulnerability in the netty-codec-http library that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests(CVE-2026-42581, CVE-2026-42584).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. Netty is vulnerable to multiple vulnerability that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests. This may lead to inconsistent request parsing and...

Security Bulletin: IBM Storage Protect Server is susceptible to a vulnerability due to Golang net library (CVE-22026-33814)

Summary Golang net library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang net is affected by vulnerability that may allow prototype pollution, allowing attackers to manipulate object prototype attributes through vulnerable merge and object conversion APIs...

Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server.

Summary IBM Storage Protect Server, which uses IBM Db2, may be affected by multiple vulnerabilities that could result in denial of service or the loss of confidentiality, integrity. These vulnerabilities include CVE-2025-36122, CVE-2025-14688, CVE-2025-67735, CVE-2025-68161, CVE-2025-12183,...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse Jersey-client library that could cause critical SSL/TLS security configurations issues (CVE-2025-12383).

Summary IBM Storage Protect Server uses the Eclipse Jersey-client library in certain components. A vulnerability in Jersey could cause critical SSL/TLS security configurations issues, which may lead to unauthorized trust of insecure or malicious servers, potentially compromising the confidentiali...

Security Bulletin:IBM Storage Protect Server is affected by a vulnerability in the Apache POI library that could lead to denial-of-service when processing specially crafted archive files (CVE-2019-12415).

Summary IBM Storage Protect Server uses the Apache POI library in certain components; this library is vulnerable to processing specially crafted archive files that may cause excessive memory allocation, potentially leading to a denial-of-service condition. Vulnerability Details CVEID:CVE-2019-124...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow an authenticated attacker to gain unauthorized access to protected information. (CVE-2025-14915, CWE-200)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow an authenticated attacker to gain unauthorized access to protected information or weaken security controls under specific conditions, that could...

Security Bulletin:IBM Storage Protect Operations Center is affected by a security configuration vulnerability(CVE-2025-14923)

Summary BM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow a security configuration attack under specific conditions. Vulnerability Details CVEID:CVE-2025-14923 DESCRIPTION: IBM WebSphere Application Serv...

Security Bulletin:IBM Storage Protect Operations Center is affected by a hardcoded protection mechanism vulnerability(CVE-2025-14917, CWE-1393).

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow security configuration attack caused by use of hardcoded protection mechanism for LTPA keys, that could impact the security of the affected...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow inadequate validation and processing of maliciously crafted input. (CVE-2026-4410, CWE-400)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow inadequate validation and processing of maliciously crafted input during request handling operations, that could impact the security of the...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow an attacker to trigger denial-of-service conditions. (CVE-2026-5516, CWE-362)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow an attacker to trigger denial-of-service conditions, unexpected behavior, or excessive resource consumption, that could impact the security of t...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow a remote attacker to trigger denial-of-service conditions. (CVE-2026-3621, CWE-269)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow a remote attacker to trigger denial-of-service conditions, excessive resource consumption, or unexpected application behavior, that could impact...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that could allow remote attacker to send unauthorized requests from the system (CVE-2026-1561, CWE-918)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow remote attacker to send unauthorized requests from the system, that could impact the security of the affected environment under specific...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-16184)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to execute arbitrary JavaScript by exploiting insufficient sanitization of href and...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site scripting due to Angular (CVE-2026-27970)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular internationalization i18n pipeline could allow attacker-controlled JavaScript to execute if a malicious translation file is...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to privilege escalation due to IBM WebSphere Application Server Liberty (CVE-2025-14915)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A privilege escalation vulnerability in IBM WebSphere Application Server Liberty, when the restConnector-1.0 or restConnector-2.0 feature is enabled, could allow ...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are affected by multiple vulnerabilities in IBM SDK, Java Technology Edition (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary IBM Storage Protect Client and Virtual Environments includes IBM SDK, Java Technology Edition to support Java-based components. Multiple vulnerabilities in the IBM SDK, Java Technology Edition could allow an attacker to obtain unauthorized access to sensitive information or cause a partia...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are affected by an identity spoofing vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-3621)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. Under limited conditions, when an application is deployed without authentication and authorization configured, IBM WebSphere Application Server Liberty ...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to remote code execution due to IBM WebSphere Application Server Liberty (CVE-2025-14914)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a privileged user to upload a specially crafted ZIP archive containing path...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to denial of service due to jose4j (CVE-2024-29371)

Summary IBM Storage Protect Client and Virtual Environments use the jose4j library as part of its security infrastructure. A vulnerability in jose4j could allow an attacker to cause a denial of service DoS by sending a specially crafted JSON Web Encryption JWE token with an exceptionally high...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to denial of service due to jose4j (CVE-2024-29371)

Summary IBM Storage Protect for Space Management uses the jose4j library as part of its security infrastructure. A vulnerability in jose4j could allow an attacker to cause a denial of service DoS by sending a specially crafted JSON Web Encryption JWE token with an exceptionally high compression...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A vulnerability in Angular's HttpClient could allow the leakage of Cross-Site Request Forgery XSRF tokens when protocol-relative URLs are used, potentially exposing the token to an...

Security Bulletin: IBM Storage Protect for Space Management is affected by an identity spoofing vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-3621)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. Under limited conditions, when an application is deployed without authentication and authorization configured, IBM WebSphere Application Server Liberty is...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A vulnerability in Angular's HttpClient could allow the leakage of Cross-Site Request Forgery XSRF tokens when protocol-relative URLs are used, potentially exposing the token to an attacker-controlled...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to remote code execution due to IBM WebSphere Application Server Liberty (CVE-2025-14914)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a privileged user to upload a specially crafted ZIP archive containing path traversal...

Security Bulletin: IBM Storage Protect for Space Management is affected by multiple vulnerabilities in IBM SDK, Java Technology Edition (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary IBM Storage Protect for Space Management includes IBM SDK, Java Technology Edition to support Java-based components. Multiple vulnerabilities in IBM SDK, Java Technology Edition could allow an attacker to obtain unauthorized access to sensitive information or cause a partial denial of...

Security Bulletin: Vulnerability in WebSphere Application Server Liberty affect Cloud Pak System Pattern Type

Summary Arbitrary file read vulnerability affects WebSphere Application Server Liberty which is bundled as WebSphere Application Server liberty pattern type with IBM Cloud Pak System CVE-2026-11806. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise Webapps

Summary Multiple vulnerabilities were addressed in IBM Aspera Enterprise Webapps version 1.0.5 Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to linkify-it and httpcore5 (CVE-2026-59887, CVE-2026-54428 & CVE-2026-54399)

Summary IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to linkify-it and httpcore5. Vulnerability Details CVEID:CVE-2026-59887 DESCRIPTION: linkify-it is a links recognition library with full Unicode support...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules undici, js-yaml, fast-uri, protobufjs and @opentelemetry/core...

Security Bulletin: IBM WebSphere Automation is vulnerable to multiple CVEs affecting multiple mongo packages within MongoDB

Summary IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod, mongodb & mongos packages within MongoDB. Vulnerability Details CVEID:CVE-2026-8053 DESCRIPTION: An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database writ...

Security Bulletin: IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod package within MongoDB

Summary IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod package within MongoDB. Vulnerability Details CVEID:CVE-2026-6914 DESCRIPTION: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. Thi...

Security Bulletin: IBM WebSphere Automation is affected by multiple CVEs in the jackson-databind package

Summary IBM WebSphere Automation is affected by multiple CVEs in the jackson-databind package. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8,...

Security Bulletin: IBM WebSphere Automation is affected by CVE-2026-41115 in the kafka-clients package

Summary IBM WebSphere Automation is affected by CVE-2026-41115 in the kafka-clients package Vulnerability Details CVEID:CVE-2026-41115 DESCRIPTION: An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the...

Security Bulletin: Unauthenticated Session History Access via Public Flow Execution

Summary A session ID namespace bypass vulnerability existed in Langflow OSS' POST /api/v1/buildpublictmp/flowid/flow endpoint that allowed unauthenticated attackers to access chat history from other users' sessions. The endpoint accepted an inputs.session parameter that could override the session...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by an authentication bypass

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by an authentication bypass CVE-2026-16184 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by cross-site scripting and deserialization vulnerabilities

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details...

Security Bulletin: Multiple Vulnerabilities Identified in Apache Neethi Allowing Denial of Service and Unauthorized Outbound Requests, which impacts IBM Tivoli Netcool Configuration Manager

Summary IBM Tivoli Netcool Configuration Manager version 6.4.2 addresses multiple vulnerabilities in Apache Neethi. These vulnerabilities could allow attackers to cause a denial of service through specially crafted WS-Policy documents or malicious policy references. Exploitation may result in...

Security Bulletin: IBM Jazz for Service Management is affected by multiple vulnerabilities in Apache ActiveMQ

Summary IBM Jazz for Service Management is affected by multiple vulnerabilities in Apache ActiveMQ CVE-2026-49432,CVE-2026-49434,CVE-2026-50734,CVE-2026-53916,CVE-2026-53917,CVE-2026-54475 Vulnerability Details CVEID:CVE-2026-49432 DESCRIPTION: Improper Input Validation vulnerability in Apache...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for July 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF001 Vulnerability Details CVEID:CVE-2026-41602 DESCRIPTION: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. User...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-10842 etc.)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j. Even though Rhapsody risk impact was low we have addressed these Vulnerability on our latest iFIx for all versions. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The...