Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-13676)

Summary There are vulnerabilities in fast-uri-3.1.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-13676. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicod...

Security Bulletin: MongoDB Enterprised Advanced affected by: Path Traversal (CVE-2026-49356)

Summary There are vulnerabilities in core-7.26.10.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-49356. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-49356 DESCRIPTION: Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc...

Security Bulletin: MongoDB Enterprised Advanced affected by: Open Redirect (CVE-2026-40181)

Summary There are vulnerabilities in router-1.23.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40181. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40181 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7...

Security Bulletin: MongoDB Enterprised Advanced affected by: NULL Pointer Dereference (CVE-2026-8723)

Summary There are vulnerabilities in qs-6.14.2.tgz, qs-6.15.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-8723. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-8723 DESCRIPTION: Summary qs.stringify throws TypeError when called with...

Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Recursion (CVE-2026-45205)

Summary There are vulnerabilities in commons-configuration2-2.10.1.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-45205. The vulnerability has/vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in...

Security Bulletin: MongoDB Enterprised Advanced affected by: Data Amplification, Uncontrolled Resource Consumption (CVE-2025-58057, CVE-2026-42583)

Summary There are vulnerabilities in netty-codec-4.1.132.Final.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-58057, CVE-2026-42583. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-58057 DESCRIPTION: Netty is an asynchronous event-driven network...

Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Resource Consumption (CVE-2026-44240)

Summary There are vulnerabilities in basic-ftp-5.3.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-44240. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-44240 DESCRIPTION: basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is...

Security Bulletin: MongoDB Enterprised Advanced affected by: CRLF Injection (CVE-2026-41417)

Summary There are vulnerabilities in netty-codec-http-4.1.132.Final.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-41417. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-41417 DESCRIPTION: Netty allows request-line validation to be bypassed when a...

Security Bulletin: MongoDB Enterprised Advanced affected by: Deserialization of Untrusted Data (CVE-2026-42778, CVE-2026-42779)

Summary There are vulnerabilities in mina-core-2.2.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-42778, CVE-2026-42779. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-42778 DESCRIPTION: The fix for CVE-2026-41409 was not applied to the 2.1.X...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Validation of Specified Quantity in Input (CVE-2026-33349)

Summary There are vulnerabilities in fast-xml-parser-4.4.1.tgz, fast-xml-parser-5.2.5.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33349. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33349 DESCRIPTION: fast-xml-parser allows users to process X...

Security Bulletin: MongoDB Enterprised Advanced affected by: Cross-site Scripting (CVE-2026-33916)

Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33916. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33916 DESCRIPTION: Handlebars provides the power necessary to let users build semantic...

Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Improper Check for Unusual or Exceptional Conditions, Cross-site Scripting (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)

Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-33937 DESCRIPTION:...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Authorization (CVE-2026-33186)

Summary There are vulnerabilities in google.golang.org/grpc-v1.78.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33186. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions pri...

Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Prototype Pollution (CVE-2025-13465, CVE-2026-2950, CVE-2026-4800)

Summary There are vulnerabilities in lodash-4.17.21.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-13465, CVE-2026-2950, CVE-2026-4800. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are...

Security Bulletin: MongoDB Enterprised Advanced affected by: Path Traversal (CVE-2026-39406)

Summary There are vulnerabilities in node-server-1.19.11.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39406. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39406 DESCRIPTION: @hono/node-server allows running the Hono application on Node.js. Prio...

Security Bulletin: MongoDB Enterprised Advanced affected by: CRLF Injection (CVE-2026-39983)

Summary There are vulnerabilities in basic-ftp-5.2.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39983. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39983 DESCRIPTION: basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows F...

Security Bulletin: MongoDB Enterprised Advanced affected by: Allocation of Resources Without Limits or Throttling (CVE-2026-35469)

Summary There are vulnerabilities in github.com/moby/spdystream-v0.5.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-35469. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-35469 DESCRIPTION: spdystream is a Go library for multiplexing streams over SPD...

Security Bulletin: MongoDB Enterprised Advanced affected by: Deserialization of Untrusted Data (CVE-2026-41409, CVE-2026-41635)

Summary There are vulnerabilities in mina-core-2.2.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-41409, CVE-2026-41635. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-41409 DESCRIPTION: The fix for CVE-2024-52046 in Apache MINA...

Security Bulletin: MongoDB Enterprised Advanced affected by: Allocation of Resources Without Limits or Throttling (CVE-2025-8916)

Summary There are vulnerabilities in bcpkix-fips-1.0.7.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-8916. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-8916 DESCRIPTION: Allocation of Resources Without Limits or Throttling vulnerability in...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability (CVE-2026-78658)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an information disclosure vulnerability when processing redacted property values. CVE-2026-78658. Vulnerability Details CVEID:CVE-2026-78658 DESCRIPTION: IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Request/Response Smuggling vuln in Netty (CVE-2026-59898)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the server-agent communication systems. CVE-2026-59898. Vulnerability Details CVEID:CVE-2026-59898 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final an...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to multiple Netty vulnerabilities (CVE-2026-59899, CVE-2026-59921)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the server-agent communication systems. CVE-2026-59899, CVE-2026-59921. Vulnerability Details CVEID:CVE-2026-59899 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions...

Security Bulletin: Multiple vulnerabilities within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within KCCI WebSphere Liberty Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-57819 DESCRIPTION: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 11 and 5.4.0 before Patch 6. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in Bouncy Castle for Java

Summary he IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in Bouncy Castle for Java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59640 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check orac...

Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle vulnerabilities that could cause denial of service, resource exhaustion, cryptographic verification bypass, or other security impacts.

Summary IBM Tivoli Netcool Configuration Manager version 6.4.2 addresses multiple vulnerabilities in Bouncy Castle components. These vulnerabilities could allow attackers to cause denial of service, excessive resource consumption, application crashes, bypass cryptographic verification, or trigger...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-5450 DESCRIPTION: Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to version 2.43 with a format wid...

Security Bulletin: Due to the use of mchange-commons-java, IBM webMethods BPM is vulnerable to Unsafe Reflection ( CVE-2026-55153 )

Summary IBM webMethods BPM includes the standalone utility which includes the vulnerable component mchange-commons-java. The tool operates as a standalone utility and is not part of the main runtime environments. Vulnerability Details CVEID:CVE-2026-55153 DESCRIPTION: mchange-commons-java is a Ja...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary BM Maximo Application Suite - Predict Component uses setuptools-80.10.2-py3-none-any.whl Publicly disclosed vulnerability found by Scanner which are vulnerable to CVE-2026-59890. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-59890...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service which are vulnerable to CVE-2026-4410, CVE-2026-5516 This bulletin contains information addressing the vulnerability. Vulnerabili...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications

Summary Multiple Vulnerabilities were disclosed as part of the Oracle July 2026 CPU plus four additional vulnerabilities Critical Patch Update.. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overfl...

Security Bulletin: IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2026-54515 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

Security Bulletin: Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access Vulnerability Details CVEID:CVE-2026-11927 DESCRIPTION: IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

Security Bulletin: IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [CVE-2026-18175, CVE-2026-18221]

Summary IBM i is vulnerable to manipulation of database transactions due to improper authorization CVE-2026-18175 and allowing unathorized access due to improper validation CVE-2026-18221 in Distributed Data Management DDM / Distributed Relational Database Architecture DRDA as described in the...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in axios

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in axios. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-67312 DESCRIPTION: axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by torch(Publicly disclosed vulnerability (CVE-2024-31583, CVE-2024-31580)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2024-31583, CVE-2024-31580 Vulnerability Details CVEID:CVE-2024-31583 DESCRIPTION: Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp. CWE:CWE-416:...

Security Bulletin: IBM i is Affected By Buffer Overflow Vulnerability [CVE-2026-18341]

Summary IBM i is vulnerable to a buffer overflow due to an integer underflow CVE-2026-18341 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18341 DESCRIPTION: IBM i could allow a remote authenticated attacker to corrupt memory due to an integer underflow...

Security Bulletin: IBM i is Affected By Denial of Service Vulnerability [CVE-2026-17255]

Summary IBM i is vulnerable to a denial of service due to improper validation CVE-2026-17255 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17255 DESCRIPTION: IBM i could allow a remote attacker to cause a denial of service due to improper validation of th...

Security Bulletin: Multiple vulnerabilies in Netty impacting IBM webMethods API Management

Summary Multiple vulnerabilities in Netty have been addressed in IBM webMethods developer portal and IBM webMethods ControlPlane Vulnerability Details CVEID:CVE-2026-42579 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final,...

Security Bulletin: vulnerable Server-side Template Injection (freemarker-2.3.26-incubating.jar) found in IBM webMethods API Management

Summary freemarker-2.3.26-incubating.jar vulnerable to Server-side Template Injection. This can be further leveraged for file system access and code execution Vulnerability Details ID:WS-2020-0455 DESCRIPTION: Affected versions of this package are vulnerable to Server-side Template Injection SSTI...

Security Bulletin: Multiple vulnerabilities found in IBM DataPower Interact Gateway 12.1.1.1

Summary Multiple vulnerabilities found in IBM DataPower Interact Gateway 12.1.1.1, which are addressed in Fix Pack 12.1.1.2 Vulnerability Details CVEID:CVE-2026-73086 DESCRIPTION: nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the...

Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. JavaScript is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fix...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.324 Vulnerability Details CVEID:CVE-2026-44892 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to version...

Security Bulletin: Multiple vulnerabilities affect IBM Sterling Connect:Direct for Microsoft Windows

Summary There are vulnerabilities in IBM Semeru Runtime version 17 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs CVE-2026-41254, CVE-2026-47063, CVE-2026-60147, CVE-2026-46968, CVE-2026-47027,...

Security Bulletin: IBM Edge Data Collector component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector component uses multiple third-party libraries which are vulnerable to several security vulnerabilities. The CVE details are listed below in the Vulnerability Details section. This bulletin provides information about the affected components and the remediation for...

Security Bulletin: SOAR App Host is vulnerable to using components with known vulnerabilities (CVE-2026-41254, CVE-2026-47057)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. SOAR APP host has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an...

Security Bulletin: IBM Security SOAR is vulnerable to using components with known vulnerabilities (CVE-2026-69247, CVE-2026-69248, CVE-2026-69249)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM Security SOAR has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to...

Security Bulletin: IBM Security SOAR is vulnerable to using components with known vulnerabilities (CVE-2026-41254, CVE-2026-47057)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM Security SOAR has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

Summary IBM ContextForge MCP Gateway contains a server-side request forgery SSRF vulnerability in its Agent-to-Agent A2A invocation endpoint POST /a2a/agentname/invoke. Unlike every other outbound egress path in the gateway, the A2A invocation path does not pin the DNS-resolved IP address at...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

Summary IBM ContextForge MCP Gateway mcp-contextforge-gateway validates REST tool target URLs for server-side request forgery SSRF only once, at tool-registration time. When the same tool is later invoked, the stored URL is used directly without re-validation or DNS-resolution pinning, allowing a...