Security Bulletin: IBM watsonx.data integration (Data Observability) is affected by an execute code over a network due to azure_core vulnerability.

Summary IBM watsonx.data integration Data Observability is vulnerable to azurecore-1.30.2-py3-none-any.whl CVE-2026-21226. Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network. Vulnerability Details...

Security Bulletin: IBM watsonx.data integration (Data Observability) is affected by a denial-of-service (DoS) due to protobuf

Summary IBM watsonx.data integration Data Observability is vulnerable to protobuf-3.20.3-cp39-cp39-manylinux25x8664.manylinux1x8664.whl CVE-2026-0994. A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed...

Security Bulletin: terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Summary The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498...

Security Bulletin: terraform-mcp-server vulnerable to server side request forgery leading to token exposure

Summary The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an...

Security Bulletin: terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

Summary The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat [CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515]

Summary Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515. Apache tomcat is used in our speech microservices. These vulnerabilitie...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2025-14087...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-9071)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 uses gix and gix-submodule crates that are vulnerable to command injection. Vulnerability Details CVEID:CVE-2026-40034 DESCRIPTION: gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of the cargo crate

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 ships a version of the cargo crate that incorrectly handles symlinks inside tar balls. Vulnerability Details CVEID:CVE-2026-5222 DESCRIPTION: Cargo between 1.68 and 1.96 incorrectly normalized the URLs of...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects TS3100/TS3200 (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects TS3100/TS3200. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a...

Security Bulletin: Unauthenticated User Could Gain Remote Access to TS3100/TS3200 (CVE-2016-9005)

Summary IBM TS3100/TS3200 Tape Library could allow an unauthenticated user, with access to the company network, to change a user's password and gain remote access to the system. Vulnerability Details CVEID:CVE-2016-9005 DESCRIPTION: IBM TS3100-TS3200 Tape Library could allow an unauthenticated...

Security Bulletin: Vulnerability in SSLv3 affects IBM System Storage Tape Controller 3592 Model C07 (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM System Storage Tape Controller 3592 Model C07. Vulnerability Details CVE ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attack...

Security Bulletin: Security Vulnerability in the IBM Java Runtime Environment (JRE) affect the 3592 Enterprise Tape Controller

Summary Vulnerabilities in in the IBM Java Runtime Environment JRE , affect the 3592 Enterprise Tape Controller. These vulnerabilities were disclosed in the Java Critical Patch Updates for July and October 2015 Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified vulnerability a...

Security Bulletin: Vulnerability in SSLv3 affects TS3100/TS3200 (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in TS3100/TS3200. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : Product could allow a remote attacker to obtain sensitive information...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of the openssl crate

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 ships a version of the openssl crate that contains multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-42327 DESCRIPTION: rust-openssl provides OpenSSL bindings for the Rust programming language. Fr...

Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access (CVE-2011-1372)

Abstract Administrative access to the library may be obtained without supplying proper credentials. Content Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access CVE-2011-1372 SUMMARY: Administrative access to the library may be obtained...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix-fs

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 uses version 0.19 of the gix-fs crate which is vulnerable to improper link resolution before file access. Vulnerability Details CVEID:CVE-2026-44471 DESCRIPTION: gitoxide is an implementation of git written in...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in the latest release and fixpack Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily exploitable vulnerability issue that...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of th...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities CVE-2026-2332, CVE-2026-5795, CVE-2025-11143, CVE-2026-33227, CVE-2026-39304 affect IBM Sterling Secure Proxy and are addressed in the latest release and ifix. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and ifix. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle...

Security Bulletin: IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528 )

Summary IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details CVEID:CVE-2026-14512 DESCRIPTION: IBM WebSphere Application Server traditional is vulnerable to pre-authentication unsafe deserialization which could allo...

Security Bulletin: IBM Maximo Application Suite uses postcss-8.4.49.tgz which is vulnerable to CVE-2026-41305.

Summary IBM Maximo Application Suite uses postcss-8.4.49.tgz which is vulnerable to CVE-2026-41305. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-41305 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and...

Security Bulletin: IBM Maximo Application Suite uses dompurify-3.3.2.tgz which is vulnerable to CVE-2026-41238, CVE-2026-41239, CVE-2026-41240.

Summary IBM Maximo Application Suite uses fdompurify-3.3.2.tgz which is vulnerable to CVE-2026-41238, CVE-2026-41239, CVE-2026-41240. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-41238 DESCRIPTION: DOMPurify is a DOM-only...

Security Bulletin: IBM Maximo Application Suite uses python_dotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684.

Summary IBM Maximo Application Suite uses pythondotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a...

Security Bulletin: IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details CVEID:CVE-2026-14974 DESCRIPTION: IBM WebSphere Application Server traditional could allow a remote attacker to execute arbitrary...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Cryptographic Algorithm vulnerability in Bouncy Castle [CVE-2026-5588]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc, due to a flaw in BC-JAVA bcpkix on all pkix modules CVE-2026-5588. Bouncy Castle is used in our speech microservices. This vulnerabili...

Security Bulletin: IBM Rhapsody Systems Engineering is vulnerable to prototype pollution abuse

Summary A security vulnerability was identified in the axios package used in IBM Rhapsody Systems Engineering. The issue has been resolved and patched. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and...

Security Bulletin: IBM WebSphere Application Server is affected by a privilege escalation (CVE-2026-14446)

Summary IBM WebSphere Application Server is affected by a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2026-14446 DESCRIPTION: IBM WebSphere Application Server is vulnerable to broken access control/privilege escalation in the administrative console. CWE:CWE-306: Missing...

Security Bulletin: IBM WebSphere Application Server is affected by an authentication bypass (CVE-2026-16184)

Summary IBM WebSphere Application Server is affected by an authentication bypass. Vulnerability Details CVEID:CVE-2026-16184 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. CWE:CWE-862: Missing...

Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j

Summary IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j. Even though Rhapsody TestConductor risk impact was low we have addressed these Vulnerability on our latest iFIx for all versions. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socke...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a security bypass vulnerability

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a security bypass vulnerability CVE-2026-10842 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-9006)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-11536)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Hugging Face Transformers [CVE-2025-14920, CVE-2025-14921, CVE-2025-14926, CVE-2025-14927]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Hugging Face Transformers CVE-2025-14920, CVE-2025-14921, CVE-2025-14926, CVE-2025-14927. Hugging Face Transformers is used in our speech services runtimes. These vulnerabilities have been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in bouncycastle [CVE-2025-14813] [CVE-2026-0636] [CVE-2026-5598]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in bouncycastle, due to flaws in BC-JAVA on all core modules. CVE-2025-14813 CVE-2026-0636 CVE-2026-5598. Bouncy castle BC-JAVA is used in our speech microservices. This vulnerability has been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a code inconsistency in Bouncy Castle [CVE-2026-8149]

Summary IBM Watson Speech Services Cartridge is vulnerable to a code inconsistency in Bouncy Castle packages: BC-LTS on Linux, X8664, AVX, AVX-512f CVE-2026-8149. Bouncy Castle is used in our speech microservices. This vulnerability has been addressed. Please read the details for remediation belo...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to HTTP Request/Response Smuggling in Starlette [CVE-2026-48710]

Summary IBM Watson Speech Services Cartridge is vulnerable to HTTP Request/Response Smuggling in Starlette, due to a routing algorithm which relies on the raw HTTP path while request.url is rebuilt from the Host header, potentially allowing a malformed header to make request.url.path differ from...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangSmith [CVE-2026-45134]

Summary IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangSmith, due to issues with an earlier version of the SDK's prompt pull methods and deserialize prompt manifests from the LangSmith Hub CVE-2026-45134. LangSmith is used in our runtime...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangChain [CVE-2026-44843]

Summary IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangChain, due to older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists CVE-2026-44843. Langchain is used i...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery (SSRF) in LangChain [CVE-2026-41481]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery SSRF in LangChain, due to a failure to revalidate to redirect targets, allowing a URL pointing to an attacker-controlled server to potentially redirect to internal, localhost, or cloud metadata endpoints,...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a memory leak in UltraJSON [CVE-2026-44660]

Summary IBM Watson Speech Services Cartridge is vulnerable to a memory leak in UltraJSON, due to an issue in ujson.dump that writes to a file-like object and the write operation raises an exception, causing the serialized JSON string object to not be decremented, leaking memory. CVE-2026-44660...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in Twisted [CVE-2026-42304]

Summary BM Watson Speech Services Cartridge is vulnerable to a DOS in Twisted, due to a flaw in the twisted.names module that can cause resource exhaustion during DNS name decompression CVE-2026-42304. Twisted is used in our speech runtimes. This vulnerability has been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in Postgres [CVE-2026-54291]

Summary Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in Postgres, due to a flaw in the pgjdbc open source postgresql JDBC Driver. CVE-2026-54291. Postgres is included in our Java Microservices. This vulnerability has been addressed. Please re...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents [CVE-2026-54399]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents, due to a flaw in the HTTP/1.1 message parser CVE-2026-54399. Apache HttpComponents is used in our Java Microservices. This vulnerability has been addressed...