Security Bulletin: Due to use of IBM SDK, Java Technology Edition, IBM Tivoli Application Dependency Discovery Manager is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, used by IBM Tivoli Application Dependency Discovery Manager TADDM. These issues were disclosed as part of the Java Technology Edition Quarterly CPU - Jul 2026 - Includes Oracle July 2026 CPU plus four additional...

Security Bulletin: IBM ApplinX is vulnerable to allocation of resources without limits or throttling vulnerability caused due to parsing oversized baggage.

Summary IBM ApplinX is vulnerable to allocation of resources without limits or throttling vulnerability caused due to parsing oversized baggage. IBM ApplinX has been updated in order to address the vulnerability CVE-2026-45292. Vulnerability Details CVEID:CVE-2026-45292 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition (CVE-2026-61308, CVE-2026-71054, CVE-2026-70907, CVE-2026-60589)

Summary This bulletin for IBM SDK, Java Technology Edition covers all applicable Java SE CVEs published by Oracle as part of their August 2026 Critical Security Patch Update. For more information please refer to Oracle's August 2026 CSPU Advisory and the CVE links referenced below. Vulnerability...

Security Bulletin: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.

Summary Current security configuration lacks specific content security directives, relying on a broad fallback policy in FTM SWIFT user interfaces CVE-2025-36147. Vulnerability Details CVEID:CVE-2025-36147 DESCRIPTION: IBM Financial Transaction Manager SWIFT is vulnerable to cross-site scripting...

Security Bulletin: IBM i is Affected By An Incorrect Authorization Vulnerability [CVE-2026-16941]

Summary IBM i is vulnerable to allowing a remote authenticated attacker to modify certain system messages CVE-2026-16941 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16941 DESCRIPTION: IBM i could allow a remote authenticated attacker to modify certain...

Security Bulletin: IBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service [CVE-2026-16892]

Summary IBM i is vulnerable to allowing a remote authenticated attacker to bypass security restrictions CVE-2026-16892 in Network Authentication Service NAS as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16892 DESCRIPTION: IBM i could allow a remote...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Debug Server

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-16826, CVE-2026-17499, CVE-2026-17273, CVE-2026-17259, CVE-2026-18076, CVE-2026-17274, CVE-2026-17270, CVE-2026-18073 in Debug Server as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16826...

Security Bulletin: IBM i is Affected By Cryptographic Algorithm Weakness in DCM [CVE-2026-16693]

Summary IBM i is vulnerable to allowing an authenticated attacker to obtain sensitive information CVE-2026-16693 in Digital Certificate Manager DCM as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16693 DESCRIPTION: IBM i could allow a remote authenticated...

Security Bulletin: IBM i is Affected By Denial of Service Vulnerabilities in NFS [CVE-2026-17057, CVE-2026-17207]

Summary IBM i is vulnerable to denial of service due to missing authentication and a buffer overflow CVE-2026-17057, CVE-2026-17207 in Network File System NFS as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17057 DESCRIPTION: IBM i could allow a remote...

Security Bulletin: IBM Maximo Application Suite uses nanoid-3.3.11.tgz which is vulnerable to CVE-2026-67213, CVE-2026-67214

Summary IBM Maximo Application Suite uses nanoid-3.3.11.tgz which is vulnerable to CVE-2026-67213, CVE-2026-67214. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-67213 DESCRIPTION: nanoid Nano ID before 5.1.6 contains an infini...

Security Bulletin: IBM Maximo Application Suite uses dompurify-3.4.7.tgz which is vulnerable to CVE-2026-65898, CVE-2026-65899, CVE-2026-65900

Summary IBM Maximo Application Suite uses dompurify-3.4.7.tgz which is vulnerable to CVE-2026-65898, CVE-2026-65899, CVE-2026-65900. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fail...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-6321)

Summary A hostname parsing discrepancy vulnerability in the fast-uri URI parsing library CVE-2026-6321 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-6321 DESCRIPTION: fast-uri decoded percent-encode...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in the IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs: CVE-2026-47027, CVE-2026-47063, CVE-2026-60147 Vulnerability Details CVEID:CVE-2026-47063 DESCRIPTION: Easily exploitable vulnerabilit...

Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities

Summary IBM Guardium Data Security Center has addressed these vulnerabilties with an update. Vulnerability Details CVEID:CVE-2026-16493 DESCRIPTION: A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands...

Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)

Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...

Security Bulletin: Maximo AI Service uses java 17.0.13 which is vulnerable to CVE-2025-21502.

Summary Maximo AI Service uses java 17.0.13 which is vulnerable to CVE-2025-21502. This bulletin contains information regarding the vulnerability and its fix. Vulnerability Details CVEID:CVE-2025-21502 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for August 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF002 Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses langchain-text-splitters 0.3.9, flask 3.1.0, coreutils 8.32-39.el9 and libxml2 2.9.13-14.el98.1 which are vulnerable to PSIRT-GHSA-fv5p-p927-qmxr, CVE-2025-47278, CVE-2026-27205, CVE-2025-5278 and CVE-2025-6170. This bulletin contains information regarding the...

Security Bulletin: Maximo AI Service uses perl 0:5.32.1-481.1.el9_6 which is vulnerable to CVE-2023-47038 and CVE-2025-40909.

Summary Maximo AI Service uses perl 0:5.32.1-481.1.el96 which is vulnerable to CVE-2023-47038 and CVE-2025-40909. This bulletin contains information regarding the vulnerability and its fix. Vulnerability Details CVEID:CVE-2023-47038 DESCRIPTION: A vulnerability was found in perl 5.30.0 through...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2026-4917, CVE-2026-4918, CVE-2026-4919)

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-4917 DESCRIPTION: IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the system. An attacker could send a specially crafted URL...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery in OAuth gateway registration

Summary IBM ContextForge MCP Gateway contains a server-side request forgery SSRF vulnerability in the OAuth gateway registration feature. When a gateway is registered with authtype="oauth" and granttype="clientcredentials", caller-supplied URL fields within oauthconfig including tokenurl,...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses cryptography-46.0.7-cp311-abi3-manylinux234x8664.whl, pyjwt-2.12.1-py3-none-any.whl, jackson-databind-2.21.2.jar, jackson-core-2.21.2.jar, protobufjs-8.0.1.tgz, websocket-driver-0.7.4.tgz, pyasn1-0.6.3-py3-none-any.whl, js-yaml-3.14.2.tgz which is...

Security Bulletin: IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures

Summary IBM ContextForge MCP Gateway includes regexfilter and denyfilter plugins that operators configure as security controls for PII redaction, secret scrubbing, prompt-injection filtering, and forbidden-content blocking. These plugins contain a filter bypass vulnerability CVE-PENDING where the...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses jackson-databind-2.21.2.jar, dompurify-3.4.11.tgz, requests-2.32.5-py3-none-any.whl, dompurify-3.4.2.tgz, pyjwt-2.12.1-py3-none-any.whl, and js-yaml-3.14.2.tgz which is vulnerable to CVE-2026-59888, CVE-2026-59889, CVE-2026-66010, CVE-2026-25645,...

Security Bulletin: IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty v.26.0.0.6 which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty v.26.0.0.6 which is vulnerable to multiple CVEs. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-5516 DESCRIPTION: IBM WebSphere Application Serv...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an Interpretation Conflict due to Node.js module fast-uri (CVE-2026-16221)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to an Interpretation Conflict due to Node.js module fast-uri Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0...

Security Bulletin: Multiple Vulnerabilities in Java affecting IBM Knowledge Catalog and IBM Master Data Management Neo4j On Cloud Pak for Data

Summary Multiple Vulnerabilities in Java affecting IBM Knowledge Catalog Neo4j On Cloud Pak for Data Multiple Vulnerabilities in Java affectingIBM Master Data Management Neo4j On Cloud Pak for Data Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an intege...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION:...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in security patch ina-release-callhomeimage-1.0.2.3. Vulnerability Details CVEID:CVE-2026-8384 DESCRIPTION: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in security patch INA-release-9.6.26.08.SP03. Vulnerability Details CVEID:CVE-2026-27448 DESCRIPTION: pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, i...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses httpclient5-5.6.2.jar, aiohttp-3.13.4-cp311-cp311-manylinux2014x8664.manylinux217x8664.manylinux228x8664.whl, ip-address-10.2.0.tgz, datasets-3.6.0-py3-none-any.whl, jackson-databind-2.21.4.jar, keras-3.13.2-py3-none-any.whl, log4j-api-2.24.3.jar,...

Security Bulletin: Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

Summary Langflow contains two vulnerabilities affecting client-side security and access control integrity. The MarkdownField component renders chat messages using the rehypeRaw plugin without a sanitization pass, causing attacker-controlled LLM response text containing raw HTML to be inserted...

Security Bulletin: Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

Summary Langflow uses outbound HTTP request functionality as part of several flow components, including components for LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. These components accept user-supplied URL values and issue...

Security Bulletin: Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

Summary Langflow contains two authenticated vulnerabilities that allow an attacker to write or delete arbitrary files on the server filesystem accessible to the Langflow process identity. The SaveToFileComponent constructs file paths directly from the attacker-controlled file name field supplied...

Security Bulletin: Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

Summary Langflow contains two authenticated information disclosure vulnerabilities. The MCP Tools component caches discovered tools in a shared process-local cache keyed only by the MCP server display name without including the user, session, flow, or resolved configuration; when two authenticate...

Security Bulletin: Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

Summary Langflow contains multiple authenticated path-traversal vulnerabilities that allow an attacker to read arbitrary files accessible to the Langflow server process, bypassing the LANGFLOWRESTRICTLOCALFILEACCESS=true security control. The ChatInput component's files parameter accepts absolute...

Security Bulletin: Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint

Summary Langflow contains an authorization policy bypass vulnerability that allows a non-superuser authenticated attacker to execute arbitrary Python code as the Langflow service identity despite the LANGFLOWCUSTOMCOMPONENTADMINONLY=true security control. The dedicated custom component API...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Babel (@babel/helpers) (CVE-2025-27789)

Summary A ReDoS and performance degradation vulnerability in Babel CVE-2025-27789 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading @babel/helpers to versions 7.27.4 and 7.29.2. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Apache Thrift

Summary IBM SPSS Modeler is affected by vulnerabilities in Apache Thrift. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime. These vulnerabilities are addressed. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut...

Security Bulletin: Multiple Security Vulnerabilities in axios affect Content Cortex for Microsoft Office

Summary axios versions before 1.18.0 0.x: before 0.33.0 have multiple vulnerabilities CVSS up to 8.3, High. CVE-2026-67312/67313 are uncontrolled recursion issues in formDataToJSON that exhaust the call stack via deeply nested field names, causing denial of service. CVE-2026-67314/67316/67319 are...

Security Bulletin: Vulnerabilities in spring-core-5.3.25.jar and spring-expression-6.1.11.jar (CVE-2026-41850, CVE-2026-41851, CVE-2026-41852, CVE-2026-41848) affect IBM PowerVM Novalink.

Summary The spring-core-5.3.25.jar and spring-expression-6.1.11.jar are used by IBM PowerVM Novalink. IBM PowerVM Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS atta...

Security Bulletin: Vulnerabilities in IBM WebSphere Profile (CVE-2026-9563, CVE-2026-10842, CVE-2026-11897, CVE-2026-15057, CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325) affect PowerVM Novalink

Summary The IBM WebSphere Liberty Profile is used by PowerVM Novalink. PowerVM Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-10842 DESCRIPTION: IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server ...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75838 DESCRIPTION: DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization whe...

Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses ansible_core-2.19.11, postcss-8.5.10 and dompurify-3.4.11 which are vulnerable to CVE-2026-16493, CVE-2026-45623, CVE-2026-69153 and CVE-2026-66010

Summary IBM Maximo Application Suite - Cluster Performance Insights uses ansiblecore-2.19.11, postcss-8.5.10 and dompurify-3.4.11 which are vulnerable to CVE-2026-16493, CVE-2026-45623, CVE-2026-69153 and CVE-2026-66010. This bulletin contains information regarding these vulnerabilities and their...

Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component uses pyasn1-0.6.3 which is vulnerable to CVE-2026-59884, CVE-2026-59885, CVE-2026-59886

Summary IBM Maximo Application Suite - Location Service for Esri Component uses pyasn1-0.6.3 which is vulnerable to CVE-2026-59884, CVE-2026-59885, CVE-2026-59886. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Details CVEID:CVE-2026-59884...

Security Bulletin: Security vulnerabilities have been identified in Java Jackson Databind library shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in Jackson Databind shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...

Security Bulletin: Security vulnerabilities have been identified in Jackson Databind shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in Jackson Databind shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...